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Abstract 

Several unintentional hypergolic fluid related spills, fires, and explosions from the Apollo Program, the 
Space Shuttle Program, the Titan Program, and a few others have occurred over the past several 
decades. Spill sites include the following government facilities: Kennedy Space Center (KSC), Johnson 
Space Center (JSC), White Sands Test Facility (WSTF), Vandenberg Air Force Base (VAFB), Cape 
Canaveral Air Force Station (CCAFS), Edwards Air Force Base (EAFB), Little Rock AFB, and McConnell 
AFB. Until now, the only method of capturing the lessons learned from these incidents has been “word of 
mouth” or by studying each individual incident report. 

The root causes and consequences of the incidents vary drastically; however, certain “themes” can be 
deduced and utilized for future hypergolic propellant handling. Some of those common “themes” are 
summarized below: 

• Improper configuration control and internal or external human performance shaping factors can 
lead to being falsely comfortable with a system 

• Communication breakdown can escalate an incident to a level where injuries occur and/or 
hardware is damaged 

• Improper propulsion system and ground support system designs can destine a system for failure 

• Improper training of technicians, engineers, and safety personnel can put lives in danger 

• Improper PPE, spill protection, and staging of fire extinguishing equipment can result in 
unnecessary injuries or hardware damage if an incident occurs 

• Improper procedural oversight, development, and adherence to the procedure can be detrimental 
and quickly lead to an undesirable incident 

• Improper materials cleanliness or compatibility and chemical reactivity can result in fires or 
explosions 

• Improper established “back-out” and/or emergency safing procedures can escalate an event 

The items listed above are only a short list of the issues that should be recognized prior to handling 
hypergolic fluids or processing vehicles containing hypergolic propellants. The summary of incidents in 
this report is intended to cover many more issues than those listed above. 
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1 Introduction 

Hypergolic fluids are toxic liquids that react spontaneously and violently when they contact each other. 
These fluids are used in many different rocket and aircraft systems for propulsion and hydraulic power 
including, orbiting satellites, manned spacecraft, military aircraft, and deep space probes. Hypergolic 
fuels include hydrazine (N 2 H 4 ) and its derivatives including monomethylhydrazine (MMH), unsymmetrical 
di-methylhydrazine (UDMH), and Aerozine 50 (A-50), which is an equal mixture of N 2 H 4 and UDMH. The 
oxidizer used with these fuels is usually nitrogen tetroxide (N 2 0 4 ), also known as dinitrogen tetroxide or 
NTO, and various blends of N 2 0 4 with nitric oxide (NO). 

Several documented, unintentional hypergolic fluid spills and fires related to the Apollo Program, the 
Space Shuttle Program, and several other programs from approximately 1968 through the spring of 2009 
have been studied for the primary purpose of extracting the lessons learned. Spill sites include KSC, 
JSC, WSTF, CCAFS, EAFB, McConnell AFB, and VAFB. Some spills or fires may not be captured in this 
document as a result of it covering several different worksites and spanning several decades. 

The Space Transportation System’s (STS) Orbital Maneuvering System and Reaction Control System 
(OMS/RCS) use hypergolic propellants to provide on-orbit maneuvering and de-orbit capabilities. 
Processing of the Space Shuttle orbiters occurs at the National Aeronautics and Space Administration’s 
(NASA) Kennedy Space Center (KSC) near Titusville, Florida; on-orbit operations are managed by 
NASA’s Johnson Space Center (JSC) in Houston, Texas; and hypergolic rocket engine checkout and 
testing occurs at NASA’s White Sands Test Facility (WSTF) in Las Cruces, New Mexico. The only 
exception to processing was when the orbiters were previously sent to Palmdale, California for an Orbiter 
Maintenance Down Period (OMDP). For OMDP the OMS/RCS pods/modules were typically removed 
from the orbiters (as they are a completely removable and replaceable unit) and transported to KSC’s 
Hypergolic Maintenance Facility (HMF). 

NASA Procedural Requirement (NPR) 8621.1 revision B was used as a classification guideline to 
establish the following mishap related definitions: 

Incident - An occurrence of a mishap or close call. 

NASA Mishap - An unplanned event that results in at least one of the following: 

a. Injury to non-NASA personnel, caused by NASA operations. 

b. Damage to public or private property (including foreign property), caused by NASA 
operations or NASA-funded development or research projects. 

c. Occupational injury or occupational illness to NASA personnel. 

d. NASA mission failure before the scheduled completion of the planned primary mission. 

e. Destruction of, or damage to, NASA property except for a malfunction or failure of 
component parts that are normally subject to fair wear and tear and have a fixed useful 
life that is less than the fixed useful life of the complete system or unit of equipment, 
provided that the following are true: 1 ) there was adequate preventative maintenance; 
and 2) the malfunction or failure was the only damage and the sole action is to replace or 
repair that component. 

Proximate Cause - The event(s) that occurred, including any condition(s) that existed 
immediately before the undesired outcome, directly resulted in its occurrence and, if eliminated or 
modified, would have prevented the undesired outcome. The proximate cause is also known as 
the direct cause(s). 

Root Cause - One of multiple factors (events, conditions, or organizational factors) that 
contributed to or created the proximate cause and subsequent undesired outcome and, if 
eliminated or modified, would have prevented the undesired outcome. Typically, multiple root 
causes contribute to an undesired outcome. 
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These definitions are utilized for the categorization of all the incidents discussed in this document. A 
summary of the categorizations can be seen in Appendix C: Detailed Assessment of Incidents. 

The intent of this report is to provide a lessons learned resource that can be utilized for future hypergolic 
system designs and operations. There have been several incidents involving injuries and damage to high 
value hardware that could have been prevented by utilizing the specific knowledge and preventative 
safety measures that are discussed in this document. Numerous engineers were interviewed that have 
been involved with the Space Shuttle Program since its genesis and the other programs that are 
mentioned. The following incidents capture what they could remember. 

The discussions in this report are by no means intended to accuse or “point fingers” by placing blame 
where it may not be appropriate. The study of incidents and mishaps is crucial for the successful future of 
the space program. Prior to the discussion on the particular incidents, the following three sub-sections 
discuss properties of three hypergolic propellants. One must understand the physics and physiological 
effects of these chemicals before being able to study and understand incidents involving them. 


1.1 Properties of Nitrogen Tetroxide (N 2 0 4 ) 

Nitrogen tetroxide is a strong oxidizing agent that is used with the hydrazine family of fuels for rocket 
propulsion in the vacuum of space. It was accepted as the rocket propellant oxidizer of choice in the 
early 1950’s by the U.S.S.R. and the United States. N 2 0 4 itself is nonflammable, non-explosive, and 
does not exothermically decompose; however, when added to a fire it will increase the intensity of 
combustion and burning rate by providing an additional oxygen source to the air. N 2 0 4 is highly corrosive 
and extremely toxic. N 2 0 4 is a liquid in equilibrium with nitrogen dioxide (N0 2 ) vapor: N 2 0 4 (liquid) <-*• 
2N0 2 (vapor). This equilibrium favors the vapor with increasing temperature and/or decreasing pressure. 
This is reversible when the conditions are the opposite. N 2 0 4 is available in various “grades” ranging 
from pure N 2 0 4 to 25% NO. The grade of nitrogen tetroxide oxidizer used in the Space Shuttle orbiters in 
the OMS/RCS has a 3% NO content (mixed oxides of nitrogen = 3% or MON-3). 

When N 2 0 4 liquid or N0 2 vapors come in contact with skin, eyes, or the respiratory system, the oxides of 
nitrogen react with water to produce nitric (HN0 3 ) and nitrous (HONO) acids that typically destroy tissue. 
Together, these compounds oxidize the moist and flexible inner tissue of the alveoli sacs within the lungs 
when inhaled. The alveoli sacs are the location in which the oxygen and carbon dioxide exchange takes 
place that is necessary for respiration. Adequate exposure will cause these affected areas oxidative 
stress and cellular death. The pulmonary capillaries are the next to die. When this occurs, the plasma 
diffuses through the vessel walls in the lungs, resulting in a build-up of fluid (edema). Since the fluid 
accumulation results from pulmonary vessel failure, the effect and symptoms may not be immediate. 
However, at high enough concentrations, immediate death from hypoxia could occur as a result of airway 
spasm, oxygen displacement, or reflex respiratory arrest. Delayed death could occur as a result of 
significant fluid build-up leading to respiratoryfailure. In non-mortal exposure cases, tissue may heal with 
scarring (in the location where the tissue was significantly exposed), leading to bronchiolitis obliterans 
(destruction of the small airways and air sacs). Survivors may have varying degrees of permanent 
restrictive lung disease with pulmonary fibrosis. 

N 2 0 4 (N0 2 ) vapors are approximately three times heavier than air and liquid N 2 0 4 evaporates about five 
times faster than water at room temperature. The vapors of MON-3 are usually reddish-brown in color, 
which is caused by rapid vaporization of N0 2 . Liquid N 2 0 4 and its vapors will explode on contact with 
hydrazine fuels, amines, and alcohol. Ignition may also occur when N 2 0 4 comes into contact with wood, 
paper, hydrocarbon fuels, and some adhesives. A mixture of N 2 0 4 and halogenated solvents: carbon 
tetrachloride, TCE, perchloroethylene, etc., may produce a violent explosion. MON-3 N 2 0 4 has the 
following properties: 

• Molecular Weight 92.016 

• Relative Vapor Density 1 .58 

• N 2 0 4 + NO, % 99.5 
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Boiling Point (14.7 psia), °F 
Freezing Point, °F 
Vapor Pressure (70 °F), psia 

Specific Gravity (77 °F) 
Ignition Capability 
Odor 

Odor Threshold, ppm 
REL, ppm (parts per million) 


70.1 

11.8 

14.57 (v p [psi] = 10 A { 5.247 - 2654 / (T[R]) + 0.00175 * (T[R]) }) 
1.423 

Not flammable 
Bleach-like 
1 to 3 

1.0 (exposure limit for NASA hardware processing) 


Density (77 °F & 14.7 psia), Ibm/gal 1 1 .96 

(Density[lbm/ff] = 95.499- 0.07804* (T[°F])+ 0.00072* (P[psig])) 

References: SP-086-2001; Hall; Rathgeber; Myers 


1.2 Properties of Hydrazine (N 2 H 4 ) 

German chemist Hermann Emil Fischer was the first to discover a hydrazine derivative (phenylhydrazine 
to be exact) in 1875. Later in 1889, free hydrazine (N 2 H 4 ) was first synthesized by German Chemist Dr. 
Julius Wilhelm Theodor Curtius. Hydrazine and its derivatives are used in the pharmaceutical, fertilizer, 
and polymer industries along with its vast use for propulsion and hydraulic power of spacecraft and 
military aircraft. 

Currently, monopropellant grade hydrazine (N 2 H 4 ) is the fuel used in the Auxiliary Power Units (APU) on 
the Space Shuttle orbiters and the Hydraulic Power Units (HPU) on the Space Shuttle Solid Rocket 
Boosters (SRBs). N 2 H 4 is also used on many spacecraft for monopropellant rocket propulsion (on the 
order of single digits to hundreds of pounds of thrust per rocket engine). To produce thrust, 
monopropellant rockets utilize a metal-based agent to catalytically decompose the N 2 H 4 into ammonia, 
nitrogen, and hydrogen. Liquid hydrazine contains about 98.5% pure N 2 H 4 with the remaining 1.5% being 
primarily water. Aerozine 50 (along with N 2 0 4 ) was used for the first and second stages of the Titan II 
Intercontinental Ballistic Missile (ICBM) and Titan space launch vehicles including the 23G (a variant of 
the Titan II used for launching medium-sized spacecraft), IIIB, MIC, and IV. The Titan II, IIIB, NIC, and IV 
rockets used the largest quantities of hypergols per launch in the history of the United States rocket fleet 
(for the first stage approximately 1 3,000 gallons of N 2 0 4 and 1 1 ,000 gallons of A-50 was used along with 
3,1 00 gallons of N 2 0 4 and 1 ,700 gallons of A-50 for the second stage). 

The Occupational Safety and Health Administration (OSHA) classifies N 2 H 4 and its derivatives as a 
possible carcinogen. N 2 H 4 and its derivatives are extremely toxic, highly flammable, and highly corrosive. 
“Hydrazines and their vapors explode on contact with strong oxidizers, such as N 2 0 4 , hydrogen peroxide, 
fluorine, and halogen fluorides. Additionally, they react on contact with metallic oxides, such as iron, 
copper, lead, manganese, and molybdenum to produce fire or explosion,” as quoted from George Hall. 
See Figure 1-1 for more information on hydrazine material compatibility as compared to pure titanium. 
Metals to the right of titanium in Figure 1-1 are less compatible with hydrazine than titanium. Metals to 
the left are more compatible. Material compatibility is quantified on a relative basis as a result of 
variables in the systems that contain the materials including pressures and thermal characteristics. 

Hydrazine fires produce little to no smoke or colorful flames. N 2 H 4 has a tendency to react exothermically 
with or without an oxidizer present (the reaction increases the temperature thus increasing the reaction 
rate; this is also known as a thermal runaway reaction). Another way to describe a hydrazine thermal 
runaway reaction is “...the rate of heat generation by the reaction exceeds the rate of heat removal from 
the system,” as quoted from F. J. Benz. This process is directly related to the auto-ignition temperature, 
which decreases as pressure increases. The exothermic reaction can end in an explosion if one or more 
of the following conditions are met within the system containing the hydrazine: the reacting system is 
confined to a rigid volume; the reacting system is adiabatic or nearly adiabatic; the reaction rate increases 
with temperature; or if the hydrazine is subjected to rapid over-pressurization through “water hammer,” as 
stated in SP-085-1999. The flammability regions for MMH and N 2 H 4 are shown in Figure 1-2. 
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gure 1-1: Hydrazine Reactivity Relative to Commercially Pure Titanium 
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Figure 1-2: Flammability Regions for MMH and Hydrazine 
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The vapor densities of all hydrazines are greater than air. Hydrazine evaporates at approximately the 
same rate as water at room temperature. N 2 H 4 liquid at room temperature and pressure is clear and oily. 
N 2 H 4 and MMH are hygroscopic (they readily absorbs water); therefore, water is widely used as a diluting 
agent. A liquid mixture of 58% water and 42% hydrazine or MMH by weight prevents ignition in an open 
air environment. A vapor mixture of 65% water and 35% hydrazine or MMH is considered nonflammable 
in air. The following are properties of N 2 H 4 : 


• Molecular Weight 

• Boiling Point (14.7 psia), °F 

• Freezing Point, °F 

• Vapor Pressure (77 °F), psia 

• Ignition Capability 

• Auto-ignites, °F 

• Ratio of Specific Heat (gas) 

• Odor 

• Odor Threshold, ppm 

• TLV-TWA, ppm 

• Density (77 °F & 14.7 psia), lb m /gal 


32.04516 

237.6 

34.75 

0.96 


4.7 to 100% by volume in air 

437 in air, 984 in GN 2 , (increases with decreasing pressure) 
1.19 


Ammonia; fishy 
2 to 3 


0.01 (exposure limit for NASA hardware processing) 
8.38 


References: SP-084-1999; SP-085-1999; Hall; Rathgeber; Benz; Occupational Exposure to Hydrazines 


1.3 Properties of Monomethylhydrazine (MMH) 

Monomethylhydrazine is the fuel used in the OMS/RCS on the Space Shuttle orbiters. Monomethyl- 
hydrazine, N 2 H 3 (CH 3 ), is similar to hydrazine, N 2 H 4 , with the exception that it contains a methyl group in 
its molecule in place of one hydrogen atom (see Figure 1-3 for an illustration of this). Most rocket grade 
MMH contains 98% pure N 2 H 3 (CH 3 ) with the remaining 2% being primarily water. MMH is not used for 
monopropellant rocket propulsion because the carbon formed in its decomposition contaminates the 
catalyst. It is extremely toxic, highly flammable, and highly corrosive. MMH has greater compatibility with 
metals as compared to N 2 0 4 as shown in Figure 1-4. All metals with a relative reactivity rate of one in 
Figure 1-4 have equal compatibility to titanium. Items below titanium (with a relative reactivity rate of 
greater than one) are less compatible. 

MMH (N?H 3 (CH 3 )) Hydrazine (N?H 4 ) 



Figure 1-3: MMH and Hydrazine Molecules 


MMH may have a slight yellow-orange tinted flame. MMH can also react exothermically with or without 
an oxidizer present, but the reaction rate has been found to be much slower than N 2 H 4 . MMH vapor has 
also been found to be much less sensitive to detonation as compared to N 2 H 4 . As a result of the 
molecular differences in comparison to N 2 H 4 , MMH has slightly different properties as shown below: 


Page 5 


NASA/TP-2009-214769 


• Molecular Weight 

• Boiling Point (14.7 psia), °F 

• Freezing Point, °F 

• Vapor Pressure (77 °F), psia 

• Ignition Capability 

• Auto-ignites in air, °F 

• Ratio of Specific Fleat (gas) 

• Odor 

• Odor Threshold, ppm 

• TLV-TWA, ppm 

• Density (77 °F & 14.7 psia), lb m /gal 


46.075 

189.5 

-62.5 

3.23 


2.5 to 98% by volume in air 

286 to 386 (increases with decreasing pressure) 

1.13 

Amine; fishy 
1 to 3 


0.01 (exposure limit for NASA hardware processing) 

7.27 

(Density [lb m /ft 3 ] = 56.926-0.03231* (T[T])+0.000252*(P[psig])) 



Figure 1-4: MMH Reactivity Relative to Commercially Pure Titanium (at 353 K) 


References: SP-085-1999; Flail; Rathgeber; Benz 


1.4 Summary of Hypergolic Fluid Properties 

NASA follows a strict time weighted average exposure concentration limit for N 2 H 4 , MMH, and N 2 0 4 for 
personnel safety during vehicle processing. The agency chose the lowest acceptable limit (Time 
weighted average or TWA) from the Occupational Safety and Health Administration’s Permissible 
Exposure Limit (OSHA PEL), the National Institute of Occupational Safety and Health’s Recommended 
Exposure Limit (NIOSH REL), and the American Conference of Governmental Industrial Hygienists’ 
Threshold Limit Value (ACGIH TLV) for its guidelines. From these organizations, NASA established that 
the threshold limit value (TLV) for N 2 H 4 and MMH would be 0.01 ppm for a conventional 8-hour work day 
and 40-hour work week. The NASA limit for N 2 0 4 exposure was taken from the NIOSH REL ceiling in 
which 1 .0 ppm is the maximum limit during any part of the workday. A value of 3 ppm is the limit for N 2 0 4 
during a conventional 8-hour work day and 40-hour work week. 

It may seem odd that with all these seemingly negative characteristics, spacecraft designers still choose 
to use hypergols for propulsion systems. This is primarily due to the fact that hypergols are storable and 
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stable (as long as they are contained properly). They also have a high specific impulse when used for 
propulsion, are stable to impact as long as there is no spark, can withstand the extremes of hot and cold 
which are present in the vacuum of space, and can be frozen and then thawed without detrimental effects 
to the chemical properties or storage vessels since they contract when frozen. However, care needs to 
be taken when hypergols are frozen in tubing. The volume of the propellant in the solid state is less than 
it is in the liquid state; therefore, as the propellant freezes, additional liquid fills the void created by the 
decrease in volume. When the propellant thaws, there is not enough volume to contain the liquid and the 
line bursts as a result of an over-pressurization, depending on the thaw pattern in the tubing. This is why 
thermal control of tubing is very important in hypergol systems. 


2 Apollo 7 SPS N 2 0 4 Spill (September 1968, CCAFS LC-34) 

In mid-September, 1968 on the mobile Service Structure of Launch Complex 34 (LC-34) at CCAFS there 
was an N 2 0 4 spill of approximately one to two gallons during post-servicing operations of the Apollo 
Service Propulsion System (SPS). A cutaway view of the SPS is shown in Figure 2-1. The mobile 
Service Structure is shown in reference to the LC-34 launch pad in Figure 2-2. The servicing was being 
completed in preparation for the scheduled October, 1968 launch of the first manned Apollo Program 
mission-Apollo 7 with the crew of Wally Schirra (Commander), Donn Eisele (Command Module Pilot), and 
Walter Cunningham (Lunar Module Pilot, even though there was not a lunar module on this mission 
utilizing a Saturn IB launch vehicle). 
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Figure 2-1: Apollo Command Module and Service Module 
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Figure 2-2: LC-34 Launch Pad and Service Structure (In Park Position) 


The Apollo SPS hypergol loading ground support equipment (GSE) consisted of two six-wheeled, flat bed 
portable tanker trailers (one for oxidizer and one for fuel) that held heavy-walled storage tanks, control 
valves, and a control console. Prior to the loading operation, the trailer was staged approximately 200 
feet from the base of the pad structure. The servicing GSE also included the portable servicing panels 
that were staged at the base of the LC-34 structure. These large panels (15 feet long, by 10 feet high, by 
8 feet wide) contained pumps, valves, and electrical cabinets inside an enclosure. Portable air dilution 
scrubbers with liquid separators were also located at the base of the launch pad separate to the trailers. 
Each had three big fans to disperse the propellant vapor. Hard-line tubing carried the propellant up the 
launch pad structure. Flexhoses were connected to the hard-lines by flanges to transfer the propellant 
from the fixed structure to the mobile structure propellant delivery system, which consisted of a valve box 
with supply and return lines and a crossover three-way valve. 

The N 2 0 4 spill occurred when a technician was disconnecting the two-inch hard-line/flexhose flange. 
Engineers thought that they had performed an adequate drain and purge of the line; however, the 
technician discovered that this was not the case (proximate cause). When he began to unbolt the flange, 
about one to two gallons of liquid N 2 0 4 poured out of the line onto the mobile Service Structure and flight 
vehicle. Liquid N 2 0 4 ran down the side of the vehicle and into the instrument unit ring, as seen in Figure 
2-3 in the Saturn 1 B cutaway view. The liquid N 2 0 4 was diluted with water, which turned out to be a poor 
decision since N 2 0 4 and water form nitric and nitrous acids. A de-stack was completed to remove the 
instrument unit ring for repair. 

It was found that the GSE propellant tubing contained a low point that trapped the liquid, not allowing it to 
be purged through the system during the post-operations of the loading procedure (root cause). This 
incident led to the requirement to install “spill protection” and “scuppers” onto the vehicle to capture any 
spilled liquid from the vehicle. The scupper is a box that is attached to the vehicle servicing door that 
serves the dual purpose of spill containment and carrying the loads that the external GSE hoses place on 
the vehicle servicing valves and fluid lines. An additional requirement was also developed mandating that 
GSE designs be free of low point liquid traps. 
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Figure 2-3: Saturn IB Launch Vehicle 


References: Benson; Perez 


3 Apollo-Soyuz Astronaut N 2 0 4 Vapor Exposure (7/24/1975, Apollo-Soyuz Test 
Project Apollo Command Module During Re-Entry) 

During reentry on July 24, 1975, following the Apollo-Soyuz Test Project’s nine-day international mission, 
Apollo-Soyuz astronauts, shown in Figure 3-1, Deke Slayton (front left), Thomas Stafford (back left), and 
Vance Brand (lower middle) were exposed to N 2 0 4 (N0 2 ) vapors for approximately four minutes and forty 
seconds. The estimated peak cabin concentration was approximately 750 ppm with an average crew 
exposure of 250 ppm. 

During reentry, the crew inadvertently performed a few tasks out sequence (root cause). The first task in 
the series was the opening of the cabin pressure relief valve to gradually equalize the cabin pressure with 
the outside air as the external ambient pressure increased during the capsule’s descent. The following 
task was the manual deployment of the drogue parachute at approximately 23,000 feet. This activity 
caused the capsule to sway. The onboard guidance, navigation, and control computers sensed this 
motion and activated the Apollo command module’s reaction control system (RCS) thrusters to counteract 
it (proximate cause). Non-combusted N 2 0 4 (N0 2 ) vapors were subsequently drawn into the capsule 
through the open cabin relief valve exit port about two feet from the closest RCS thruster. About 30 
seconds later, the crew deactivated the RCS thrusters; however, the capsule had already filled with N 2 0 4 
(N0 2 ) vapors. The thruster deactivation had been planned to be completed prior to the opening of the 
cabin pressure relief valve. 
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Figure 3-1: Apollo-Soyuz Test Project Crew 

Brand describes the reentry events during the crew technical debriefing: 

“At 30K [30,000 feet], normally we arm the ELS [Earth Landing System] AUTO, ELS LOGIC, that 
didn’t get done. Probably due to a combination of circumstance, I didn’t hear it called out, maybe 
it wasn’t called out. Any case 30K to 24K we passed through that regime very quickly. I looked 
at the altimeter at 24K, and didn’t see the expected apex cover come off. Didn’t see the drogues 
come out. So, I think at about 23K, I hit the two manual switches. One for the apex cover and 
also, the one for drogues. They came out. That same instant the cabin seemed to flood with a 
noxious gas, very high concentration it seemed to us. Tom said he could see it. I don’t 
remember for sure now, if I was seeing it, but I certainly knew it was there. I was feeling it and 
smelling it. It irritated the skin a little bit, and the eyes a little bit, and, of course, you could smell 
it. We started coughing. About that time, we armed the automatic system, the ELS...” 

The exposure greatly altered the astronauts’ abilities to complete assigned tasks in a timely manner; 
therefore, they experienced a very rough landing along with the poor luck of having the capsule splash- 
down in the “Stable 2” configuration, which meant it was inverted in the water. Following splash-down, 
the crew was forced to don their oxygen masks, but in the interim before Stafford could retrieve and 
distribute the masks, Brand (who was sitting closest to the relief valve, see Figure 3-2) lost 
coconsciousness. 

Stafford later reported: 

“For some reason, I was more tolerant to [the N0 2 vapors], and I just thought get those damn 
masks. I said don’t fall down into the tunnel. I came loose and. . .had to crawl. . .and bend over to 
get the masks...! knew that I had a toxic hypoxia... and I started to grunt-breathe to make sure I 
got pressure in my lungs to keep my head clear. I looked over at Vance [Brand] and he was just 
hanging in his straps. He was unconscious. ” 

Stafford climbed around the module to Brand and placed an oxygen mask over his mouth. With the 
oxygen mask in place, Brand regained consciousness within approximately one minute. The capsule was 
then reoriented upright and Stafford opened the vent valve, dissipating the remaining vapors. All three 
astronauts subsequently developed pneumonitis, for which they were hospitalized for about two weeks in 
Flonolulu, Flawaii. All three recovered completely. Deke Slayton and Thomas Stafford did not fly on any 
subsequent space missions. Vance Brand went on to be the commander for three Space Shuttle flights: 
STS-5, STS-41 B, and STS-35. 
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Figure 3-2: Apollo Command Module Interior Cutaway 


References: Ezell; Apollo (ASTP) 


4 OV-101 APU 1 Cavity Seal N 2 H 4 Spill (6/28/1977, Second Captive-Active Flight) 

On June 28, 1977, during Enterprise’s (OV-101) second captive-active flight with the crew of Joe Engle 
and Richard Truly, approximately five gallons of hydrazine leaked from APU number one’s cavity shaft 
seals and dumped overboard via the drain vent at the aft end of the vehicle. There was not a catch bottle 
in this early design. The incident resulted in a new design of the shaft seals and the addition of a catch 
bottle. 

The aerodynamic slipstream of the vehicle caused the hydrazine to be ingested into the left hand side of 
the aft fuselage through an access panel and vent door. There were no reported fires. There was 
extensive damage to the polyimide “Kapton” insulated wiring and interior thermal blankets near the left 
hand APU service panel from hydrazine exposure. There was also damage to the exterior thermal 
blankets. This incident seemed to bring to light the incompatibility between hydrazine and Kapton. For 
future flights, the left- and right-hand vent ports were modified to eliminate the possibility of ingestion. 
Also, the left and right access doors and T-0 umbilical doors were sealed. The root cause of the leak was 
an inadequate understanding of the flight characteristics of the APU system. Finding these types of 
design faults are, however, the exact reason that flight tests are performed. 

References: Demarchi; Olney; Lance 
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5 Titan II Silo Large Scale N 2 0 4 Spill (8/24/1978, McConnell AFB Silo 533-7) 

On August 24, 1978, at McConnell AFB southeast of Wichita, Kansas, the worst reported unintentional 
N 2 0 4 spill in U.S. history took place. Approximately 13,450 gallons of liquid N 2 0 4 spilled into the 
underground missile silo. Two members of the 381 st Strategic Missile Wing were killed and 25 more were 
injured from N 2 0 4 liquid and vapor exposure. The silo also suffered extensive damage. The Titan II first 
and second stages were an A-50/N 2 O 4 bi-propellant propulsion system. The loading operations were 
completed using a holding tanker located above ground. Recall that N 2 0 4 (N0 2 ) vapors are heavier than 
air and they boil at approximately 70 °F at ambient pressure. 

Once the N 2 0 4 loading of the rocket’s first and second stages had been completed, all that remained was 
disconnecting the quick disconnects (QDs) from the rocket air half couplings (AHC). The technicians 
wearing Rocket Fuel Handler Coverall Outfits (RFHCOs) were unaware that a Teflon o-ring seal had 
dislodged from an upstream location, moved through the filter assembly (of which there were no filter 
elements installed), through the QD, and wedged itself in between the poppet of the AHC and its primary 
sealing surface on the Titan II (proximate cause) of the spill. This prevented the isolation of the bulk 
propellant in the first stage oxidizer tanks once the QD was removed. The RFHCOs were similar to Self- 
Contained Atmospheric Protection Ensemble (SCAPE) suits that are used by the Space Shuttle Program. 
When the technician mechanically separated the QD from the AHC, approximately 13,450 gallons of 
liquid N 2 0 4 poured out of the AHC and into the missile silo. 

Very high concentrations of N0 2 vapors traveled from the silo into the connecting cableway to the blast 
lock area, which was located just outside of the control center where several personnel were located (see 
Figure 5-1). All the personnel located in the blast lock area managed to escape the vapors by exiting 
through the access portal at ground level. The personnel in the control center would normally be isolated 
from the silo; however, two technicians involved in the spill opened the airlock door to try and obtain 
assistance for their supervisor who was in need of immediate medical attention. The two technicians and 
four other control center personnel then evacuated through the emergency escape hatch, once they 
realized the immediate danger of the situation. The nearby town of Rock, Kansas had to evacuate about 
1 00 people as a result of the vapors that were escaping from the silo (see Figure 5-2). 

It was later discovered that the suit of the supervisor had failed, introducing him to dangerous levels of 
N 2 0 4 (N0 2 ) vapors, which was ultimately fatal to him within minutes of being exposed (see section 1.1 
“Properties of Nitrogen Tetroxide (N204)” for a description of what N 2 0 4 and N0 2 does to the body). Two 
other technicians had removed their suit hoods while in the vapor cloud. One died nine days later. The 
extent of the injuries of the other technician is uncertain; however, he did survive. Repairs to the 
damaged 533-7 silo were attempted, but later discontinued for budgetary reasons. The silo was never 
returned to alert status. 

Lessons learned from this incident include the following: 

• Proper configuration control of GSE components, in this case the filter, is highly important in the 
handling of toxic chemicals, especially hypergols (root cause of the incident) 

• Emergency procedures and safing must always be reviewed, practiced, and ingrained in the 
minds of personnel working with toxic chemicals 

• Procedural oversight may have been beneficial 

• Proper isolation of bulk propellant should be inherently designed into any rocket propulsion 
system and used accordingly during loading operations 

• Personal protective equipment (PPE) should be inspected prior to every use 
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Figure 5-1: Underground Titan II Missile Complex 



Figure 5-2: Arial View of N 2 0 4 Vapor Cloud Coming from Missile Silo 533-7 

Reference: Rathgeber; Titan-ll.com 
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6 N 2 H 4 Spill Following APU Hotfire (1 1/1979, KSC OPF1) 

In November of 1979, prior to the launch of STS-1 (Columbia), there was an N 2 H 4 spill of approximately 
two gallons during the propellant tank offload procedure in Orbiter Processing Facility 1 (OPF1). The spill 
occurred following an APU hotfire, which was performed as part of Columbia’s "dynamic stability" test to 
certify the vehicle for flight. APU hotfires were originally completed in the OPF using a vent that passed 
through the roof of the building to release the exhaust products. The source of the spill was found to be a 
leaking "gage saver" in the APU hydrazine servicing cart (proximate cause). It was discovered that the 
gage saver fittings had been replaced on the cart at Edwards Air Force Base (EAFB) following APU 
servicing for the Enterprise flight tests. The replacement gage savers were later determined to contain 
brass bellows, which were not compatible with N 2 H 4 (root cause). Following the shipment of the servicing 
cart to KSC, it was filled with N 2 H 4 at the Pad 39A fuel farm and then used for the servicing of Columbia in 
OPF1 for the APU hotfire test. There were no reports of hardware damage or injuries. It is not certain, 
but this incident may have led to the practice of completing APU hotfires exclusively at the launch pad. 

Reference: Heinrich; Dougert 


7 Titan II Explosion Following A-50 Spill (9/18/1980, Little Rock AFB Silo 374-7) 

On September 19, 1980, following a large A-50 spill the previous evening, the Titan II ICBM within missile 
silo 374-7 located about 2.5 miles south of Bee Branch, Arkansas, exploded. One of the 308 th Strategic 
Missile Wing’s airmen was killed and 21 other USAF personnel were injured as a result of the explosion 
and subsequent rescue operations. 

At about 6:30 PM on September 18, 1980, an airman was conducting a maintenance operation on level 
two (see Figure 7-1) of the underground silo when he accidentally dropped a large wrench socket. The 
standing platforms were hydraulically-controlled, flip-down structures with a rubber boot mounted 
between the platform and the rocket. The socket fell hitting the standing level two platform and bounced 
in the direction of the rocket where it slipped through the small gap between the rubber boot (which had 
become pliable over the years) and the Titan II rocket. It fell about 70 feet before hitting the thrust mount 
near the base of the rocket. The socket then bounced into and ruptured the stage one fuel tank 
(proximate cause). Approximately 1 1 ,140 gallons of A-50 drained into the bottom of the silo. Fuel vapors 
heated up the silo and caused the pressures in the non-ruptured propellant tanks to rise substantially. 

At about 8:00 PM the control center was evacuated (see Figure 5-1 for a view of the launch silo and 
supporting facilities) and, therefore, the capability to remotely monitor the silo and rocket system data was 
lost. The entire missile complex and the surrounding area were then evacuated and a team of specialists 
that were knowledgeable of the Titan II rocket system were called in from Little Rock AFB (the missile’s 
main support base). Also, at around this time, local residents within a one-mile radius of the missile silo 
were evacuated. Local law enforcement officers closed the nearby State Highway 65, and alerted 
anyone entering the area. 

At 3:00 AM on the following morning (September 19, 1980) two people entered the control center in 
protective suits through the emergency escape hatch. They were forced to leave shortly thereafter as a 
result of the high fuel vapor concentration causing poor visibility. Prior to leaving, one of the men 
reportedly activated the exhaust fans which pulled the fuel vapors into an equipment area where some 
electrical pumps were located. It is assumed that this is where the fire originated, however this was never 
completely proven. It is unclear if the men received orders from a superior officer to activate the exhaust 
fans or not. Following the exhaust fan activation, the two men went back to the surface and had just 
paused to await further instructions when the Titan II rocket exploded, sending an earthquake-like 
shockwave across north central Arkansas. The heat from the flames at the base of the silo increased the 
temperature at the lower end of the rocket. This eventually led to the rupture of the N 2 0 4 tank, which 
reacted hypergolically with the spilled fuel causing the explosion. One of the two men died later that day 
in the hospital (once he was located among the rubble from the explosion). The other man was thrown 
approximately 150 feet from the silo and suffered only a broken leg along with several cuts and bruises. 
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Figure 7-1: Technicians Working on Fold-Down Platform in Titan Silo Level 2 

It was reported that the explosion blew the 740-ton reinforced concrete and steel silo door (see Figure 7-2 
for a depiction of the Titan II missile silo) 200 feet into the air and 600 feet from the silo. The rocket’s 
second stage, with the W53 thermonuclear warhead attached, was launched out of the silo following the 
explosion of the first stage. The second stage then supposedly blew up in midair, (it contained about 
1,730 gallons of A-50 and 3,120 gallons of N 2 0 4 ) sending the undetonated warhead several hundred feet 
from the silo. The W53 warhead had a mass of 8,136 lb and a yield of 9,000 kilotons (the Hiroshima 
bomb “Little Boy” was estimated at about 15 kilotons). Luckily the warhead’s safety features operated as 
they were designed. There was no reported loss of radioactive material. 

The 374-7 Titan II missile silo complex was completely destroyed. The estimated value of the silo in 1980 
was approximately $225,000,000. In October of 1981, President Reagan announced that all of the Titan 
II ICBM launch sites across the United States would be deactivated by October of 1987. Along with this 
action being part of the strategic modernization program, the deactivation was related to this incident and 
the previously mentioned incident at McConnell AFB. Silo 374-7 was the first Titan II silo to be 
deactivated. The 308 th strategic missile wing was completely deactivated on August 18, 1987. 

Some lessons learned and corrective actions from this incident include: 

• All workers should wear a belt with lanyards to attach tools 

o Operational human error is, therefore, the root cause 

• Cloths should be placed on the platforms to prevent tools from bouncing off the metal 

• The Titan II missile silo platforms should be renovated to increase safety 

• The training and qualification program was insufficient prior to the incident (a root cause) 

• Communication with local authorities was inadequate, especially with reference to the nuclear 
warhead 

• Care should be taken to ensure the exclusive use of explosion proof hardware in a facility that 
contains hypergolic propellants 

o It is unclear if this incident was indeed caused by activating the exhaust fans; however, 
this is a still viable corrective action 

• Sending personnel into an unknown situation is extremely dangerous, especially one in which an 
explosion is imminent as a result of the high concentration of fuel vapors 
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Figure 7-2: Titan II Missile Silo 


References: Hartsell; Titan-ll.com; Titan II Missile Explosion 
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8 KSC Incorrect Flight Cap N2O4 Vapor Release (July 1981, KSC OPF1) 

On roughly July 14, 1981 in OPF1, there was an inadvertent release of N 2 0 4 (N0 2 ) vapors during the 
MD338 flight cap installation procedure. The cap was removed from MD338 on June 15, 1981 and 
routed to another facility with a fume hood for refurbishment. During the refurbishment procedure the 
incorrect part number (MC276-001 8-241 1, a %-inch flight cap, see Figure 8-1 for a description of the 
numbering nomenclature) was recorded for the cap and a parts tag with the incorrect number was 
attached. The correct part number was MC276-001 8-281 1 (a 14-inch oxidizer flight cap, shown in Figure 
8-2). There had been issues with oxidizer flight caps becoming corroded; therefore, a problem report 
(PR) was generated to clean the caps. During the cleaning procedure the part number that was etched 
onto the cap was sanded off and all that was left to identify the cap was the attached parts tag (which was 
incorrect). 


Coupling Size 
(in.) 

Poppet Area 
(in. 2 ) 

Force to Open 
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MD276-001 8-XXXX 

f When this is a “4” the AHC tube size is Vi-inch OD 

s When this is an “8” the AHC tube size is 14-inch OD 

Lwhen this is a “6” the AHC tube size is 1 .00-inch OD 

Figure 8-1: General Information on the MC276-0018 Air Half Coupling 



Figure 8-2: Fairchild 14-inch Flight Cap 


During the MD338 flight cap installation procedure, on roughly July 14, 1981, the work step correctly 
called for the installation of a 14-inch cap (part number MC276-001 8-2811) onto the AHC. The cap that 
was staged for installation was the misidentified 14-inch cap. When a 14-inch cap is placed onto a 14-inch 
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AHC, the dimensions of the stem allow for the actuation of the 14-inch AHC poppet (reference Figure 29-1 
for an illustration of this) if the proper force is applied to the cap and poppet. This is exactly what 
happened. An oxidizer vapor release was reported when the technician tried to install the !4-inch cap 
(proximate cause). The root causes are human error, improper configuration management, and improper 
vehicle design. The original flight cap design should not have enabled this type of incident to occur. The 
technician received minor injuries from exposure to N0 2 vapors. Close attention needs to be paid to the 
identification of flight caps and other hardware to prevent an event like this from occurring again (which it 
does on November 4, 1992 at WSTF). 

References: Wilder (LO-JW-81 -010); Craig 


9 MMH Exposure Following Flexhose Removal at Pad Farm (7/14/1981, KSC Pad 
39A Fuel Farm) 

On the morning of July 14, 1981, a technician was exposed to MMH liquid and vapors while removing an 
improperly labeled GSE flexhose from a panel at the Pad 39A (Space Shuttle and Apollo Program launch 
pad, along with 39B) fuel farm (proximate cause). The liquid MMH sprayed onto the technician’s arm and 
face, which he immediately attempted to wash off with water. The technician then reported to his 
supervisor who instructed him to wash his arm and face again, thoroughly, and formally report the 
incident. 

Upon investigation, it was found that the flexhose that was being removed was not labeled as hazardous. 
Proper labeling and configuration management guidelines were not followed (a root cause). The 
procedure had also not received a proper review by an experienced engineer (another root cause). The 
engineer that had been assigned to the procedure development task had delegated it to an engineer on 
loan from another facility and had instructed him to process the procedure as non-hazardous. Currently, 
procedures at KSC require a second review by a qualified engineer for hazardous GSE and vehicle 
operations. The technician was very lucky the carelessness in the procedure development and flexhose 
labels did not result in a more severe injury. 

Reference: Wilder (L0-JW-81-01 1 ) 


10 STS-2 OV-102 Right Pod MMH Fire (Fall 1981, KSC OPF1) 

In the fall of 1981, a small amount of MMH (approximately a teaspoon) was spilled onto the gold multi- 
layer insulation (MLI) blankets in the right OMS pod (RV01) of Columbia (OV-102). Technicians 
unknowingly opened a line that contained a small amount of liquid MMH (proximate cause of the spill). 
Apparently, instructions had been given to the technicians to remove the blankets and install spill 
protection, but this was not completed and it was not incorporated into the procedure. The gold foil of the 
MLI blanket acted as a catalyst while the blanket batting absorbed and concentrated the released MMH. 
The cause of the fire was a result of the ventilated surface area (by aspirator) creating the correct 
conditions for combustion of MMH (proximate cause of the fire). The batting acted as an insulator 
effectively containing the heat of the reaction, transferring the heat back to the MMH, and allowing the 
temperature to increase to the boiling temperature of MMH (189.5 °F). Ignition of the blanket followed 
once the vapor fumes reached the auto-ignition temperature of MMH (382 °F). A technician used nearby 
flame retardant coveralls to extinguish the flames. 

It was later determined that MMH and gold are not compatible. The two root causes of this incident were 
operational human error and improper design (incompatible materials). Silver was later used, rather than 
gold, for thermal blanket construction. Note: in the past on other programs, the catalyst beds for mono- 
propellant thrusters contained gold until the material was switched to platinum. The gold was used for its 
high reactivity with hydrazine to support combustion in the thrusters. 

Reference: Houston; Heinrich 
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11 STS-2 OV-102 N 2 0 4 Spill (9/22/1981, KSC Pad 39A 207-Foot Level) 

At 1:13 AM on September 22, 1981 an N 2 0 4 spill occurred at Pad 39A. The proximate cause of the spill 
was a failed ground half coupling (GHC), MD162, at the AP28-12 door on FRC2 of OV-102 (Columbia). 
Failure of the GHC was a result of iron nitrate build-up between the probe and the dynamic head of the 
GHC along with the tight tolerances of the GHC. See Figure 11-1, Figure 11-2, and Figure 11-3 for a 
description of the AHC and GHC flow paths and also the failure location. Between 15 to 20 gallons of 
oxidizer was released into the attached scupper, which subsequently overflowed onto the vehicle. 
Damage to thermal tile adhesive resulted in the removal of 370 tiles (shown in orange in Figure 11-4). 
The photograph in Figure 11-5 shows the thermal tiles and the underlying vehicle structure along with the 
scupper and QD flexhoses going into the AP28-00 door (second FRCS oxidizer servicing door just 
beneath the AP28-12 door when the vehicle is in the vertical orientation). 

Confusion resulted in wasted time. Immediately following the spill, the proper alarms went off at the 
launch pad’s 207’ level; however, in the Launch Control Center (LCC), the engineers on console were 
unaware of the spill source until there was visual confirmation from the technicians (who were located 
outside the FRCS room). Engineers on console executed the prewritten worksteps in the Operations and 
Maintenance Instruction (OMI) to safe the system once they realized the situation. Unfortunately, these 
steps did not include isolation of the QD from the GSE supply; therefore, the leak continued until this was 
noted and resolved. 

The spill protection was not suitable for a large leak. It was incorrectly assumed that if a spill did occur; it 
would be small and containable within the spill protection. The spill protection still in use on the Space 
Shuttle Program over 27 years later is very similar to the “temporary” redesigned spill protection following 
the STS-2 N 2 0 4 spill. 

The launch was delayed by about one month while repairs were made to the vehicle, which remained at 
the launch pad. Many of the thermal tiles were baked in an oven and reinstalled onto the orbiter, which is 
a standard procedure to remove the N 2 0 4 or N0 2 from thermal tiles when they become impregnated with 
oxidizer vapors. Several damaged thermal blankets located inside the forward module were replaced at 
the pad by accessing them through two doors adjacent to the orbiter windows. 

A committee was formed to investigate the spill and compile recommendations for improvements and 
lessons learned. The following is a summary of the lessons learned: 

• The GHC design was flawed in that there was a single point failure resulting in a leak path (a root 
cause) 

• The scupper and apron were not large enough to contain the spill 

• Using the GHC as a shut-off valve was flawed engineering practice (another root cause) 

• The emergency procedure was inadequate 

• All entry paths to the FRCS module should be sealed 

• Care must be taken in the control of iron nitrate which is always present in an N 2 0 4 system 

o Iron nitrate and its impacts to hardware were not well understood in 1981 

• Proper ventilation and lighting should be added to the FRCS room on the 207-foot level of launch 
pads 39A and 39B 

• Emergency Launch Processing System (LPS) programs could have saved time during safing 

• The communications system could have been used more efficiently 

Corroded structural components that had been exposed to oxidizer vapors were later found in the internal 
portion of the FRCS module. It is believed that the vapors entered the forward module through small test 
ports located at the external doors. Many years later it was also found that the oxidizer vapor reacted 
with several electrical connector backshells within the FRCS. 
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Figure 11-1: AHC and GHC in Open Position 
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Figure 11-2: AHC and GHC in Closed Position 
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Figure 11-3: AHC Closed and GHC Failed Open with External Leak Path Shown 
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Figure 11-4: Removed Tile from OV-102 Following STS-2 N 2 0 4 Spill 
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Figure 11-5: Photograph of AP28-00 Door and Orbiter Following the Spill 

A large amount of knowledge was gained from the spill. There were many process and GSE design 
changes implemented following the recommendations from the Mishap Investigation Committee Report. 
The following is a list of what was completed: 

• Additional GSE valves were added to isolate the liquid N 2 0 4 rather than using the QDs as valves 

o GHCs were subsequently no longer used as shut-off valves during loading 

• The scuppers were upgraded through a redesign 

• The QDs and AHCs were found to have very tight tolerances; therefore, the poppets were 
subsequently electropolished to open the tolerances 

• An improved maintenance plan was implemented for the GHCs 

• Improved local emergency procedures were implemented 

• Entry paths to the FRCS module were blocked with tape and RTV (adhesive) 

• Improved controls were put in place to minimize the amount of iron nitrate in the liquid N 2 0 4 

• The lighting in the FRCS room was enhanced 

• LPS improvements were made including automatic remote safing that was keyed from local toxic 
vapor detection devices 

Reference: Williams; Heinrich 
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12 Pad 39A Fuel Farm MMH Spill and Fire Following Pneumatic Valve R&R 
(6/29/1982, KSC Pad 39A Fuel Farm) 

On June 29, 1982 (a hot summer day with a high of 90 °F), at the Pad 39A fuel farm, there was an MMH 
spill and fire during the removal and replacement of a pneumatically controlled valve. Figure 12-1 and 
Figure 12-2 are photographs taken following the fire. Prior to the removal and replacement of the valve, 
the farm was powered down and the GN 2 valve control pressure was removed to enable the removal of 
the control pressure tubing on the pneumatic valve. When this pressure was removed, a few valves that 
were intended to remain closed, went to open (the valves were normally open valves with the pressure 
removed). This was the proximate cause. The change in valve positions went unnoticed or was ignored 
by the engineers on console. 

Immediately following the removal of the valve a small amount of fuel vapor was released from the open 
line. About a minute later, a 12- to 48-inch geyser of MMH was released from the open line and splashed 
onto a metal cable tray above and ignited either as a result of the hot metal or by some local iron oxide 
(rust). It was estimated that approximately 1 5 to 25 gallons spilled from the line. The engineer located in 
the LCC could not see the events as they occurred as a result of having a view from the Pad 39A oxidizer 
farm camera on his closed circuit television (OTV) screen, which is located approximately 1,800 feet from 
the fuel farm. 

The technicians reported the spill and immediately evacuated the farm to the camera embankment south 
of the fuel farm, removing themselves from the communications loop in the process. Once there, they 
awaited the SCAPE pickup van. The farm firex was then activated remotely by the duty officer, 
extinguishing the fire. The technicians reported that they were unable to reach the firex controls as a 
result of the flames. No one was injured in the spill and fire; however, there was a notable amount of 
damage to the GSE at the fuel farm as seen in Figure 12-1 and Figure 12-2. 

Following the fire, manual overrides were added to the liquid return isolation valve and the storage tank 
isolation valve, which cycled normally open when control pressure was removed. Improper GSE design 
was one root cause of this incident. It was also found that when the 750 psig GN 2 supply pressure was 
vented in preparation for the valve removal, the toxic vapor aspirator lost its pneumatic supply pressure. 
A pneumatic actuation valve and vent valve were added to the GSE at the propellant farms to better 
isolate the liquid MMH and the aspirator, respectively, when removing and replacing valves. Labels were 
painted in large letters on the farm roofs and sides of the propellant storage tanks to aid in the 
identification of the farms via OTV. Other findings related to this incident include the following: 

• The procedure was not written or reviewed by an experienced engineer prior to the task 

• The engineer on console was making changes to the procedure real-time while monitoring 
another task in parallel 

o Improper adherence to the procedure and the procedure approval process are also root 
causes of this incident 

• There was only one engineer on console supporting the hazardous operation 

o The engineer had to leave the communications channel to talk to the test conductor and 
in doing this missed some reports from the personnel at the fuel farm 

• There was not a charged water line nearby when the fire occurred 
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Figure 12-1: Photograph of Fuel Farm Following Fire 



Figure 12-2: Separate Pneumatic Valve (Following Fire) 


References: Tribe (L0-JT-82-044); Utsman 
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13 N 2 O 4 Vapor Release from Flange Gasket (2/10/1983, KSC Pad 39A Oxidizer 
Farm) 

During processing for the first flight (STS-6) of Challenger on February 10, 1983, there was an N 2 0 4 
vapor release at the Pad 39A oxidizer farm. Technicians and engineers were working a decay and leak 
check procedure on the fluid distribution system. The engineer on console was bringing up the system 
pressure at the farm. While this was occurring, the technicians reported a large N 2 0 4 vapor release. 
They also later described hearing a loud noise during the pressurization. The engineer secured the GSE 
and reported that there was an emergency on the communications net. The oxidizer farm was cleared of 
all personnel and a SCAPE crew was sent in. The SCAPE technicians noted that a flange gasket on an 
isolation valve had blown out and was releasing N 2 0 4 (N0 2 ) vapors (proximate cause). There were no 
injuries since all personnel at the farm were located upwind from the vapor release. This incident seems 
to have been properly managed by the technicians and engineers; however, there may have been a 
design flaw in the GSE, which could be considered a root cause. 

Reference: Kamp 


14 FRCS Ferry Plug Removal MMH Spill (4/18/1983, KSC OPF1) 

On roughly April 18, 1983, during the orbiter thruster ferry plug removal operation, liquid MMH spilled from 
two thrusters (F4D and L1L), wetness was noted in one (R1U), and vapors were noted in another (R2D). 
These events occurred during turn-around operations following the arrival of Challenger at KSC via the 
Shuttle Carrier Aircraft (SCA) from the orbiter’s maiden voyage (STS-6) and landing at EAFB. A 
technician was exposed to liquid fuel when the plug was removed from F4D (FRCS down firing thruster 
on manifold four). It was estimated that % to !4 of a cup spilled from the thruster. 

The liquid presence in the thruster chambers was likely a result of the fuel pilot operated valves leaking. 
These valves are sensitive to temperatures below 60 °F because the Teflon seals non-uniformly contract. 
Normally, the temperature was maintained above 60 °F using the thruster heaters; however, when the 
SCA and orbiter landed at KSC, the orbiter was not powered for about 36 hours. During this time period, 
the outside temperature dropped to a low of approximately 50 °F and remained below 60 °F for about 
nine hours. The following are lessons learned and corrective actions that were implemented following 
this incident: 

• Thruster heaters shall remain on during all ferry and post-landing orbiter operations 

• Ferry plug removal was upgraded from the current PPE level at the time to a SCAPE operation 

• The ferry plug relief valve shall be aspirated with the fuel aspirator prior to ferry plug removal 

o If there is any indication of oxidizer at the relief valve exit, the oxidizer aspirator shall be 
used for this operation 

The proximate cause of this incident was removing a thruster ferry plug without knowing that there was 
liquid fuel present behind it. The root cause was an improper operational understanding of the limitations 
and sensitivities of the thruster fuel valves. 

It was also noted in the corrective actions memo written by Mr. Tribe that it is less likely that the oxidizer 
thruster valves would leak since the Teflon seals swell by approximately 3% when exposed to N 2 0 4 at 
ambient temperature. The seals only swell by approximately 0.7% in the presence of MMH at ambient 
temperature. 

Reference: Tribe (L0-JT-82-043) 
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15 STS-9 OV-102 APU-1 and -2 Explosion (12/8/1983, EAFB Runway 170) 

On December 8, 1983, Space Shuttle Columbia landed at EAFB at 3:48 PM pacific local time, concluding 
the STS-9 mission. About seven minutes after landing, an unusual series of events occurred. First, APU- 
1 shut down prematurely in response to a sensed turbine “underspeed” condition. About four and a half 
minutes later an explosion occurred in the APU. Figure 15-1 shows what remained of the APU-1 fuel 
pump following the explosion along with the resulting collateral damage. At the instant of the APU-1 
explosion, APU-2 spontaneously shut down. Fifteen minutes later it exploded. Figure 15-2 is a 
photograph of APU-1 and APU-2 in the aft of OV-105 (similar to the OV-102 configuration). APU-3 ran 
nominally. 

Failure analysis indicated that stress corrosion cracking of the injector tube created the leak into APU-Ts 
gas generator cavity (proximate cause). In the vacuum of space, the hydrazine froze in the cavity and 
remained stable throughout the orbital phase of the mission. However, when the vehicle started its re- 
entry, the hydrazine thawed, expanded, vaporized, and then eventually caused the gas generator to 
explode. The following is quoted from the Space Shuttle Mission Evaluation Room (MER) database: 

“Post-flight data review indicated that hydrazine leakage first occurred approximately 17 minutes 
after APU-1 and -2 were started for entry. This condition was indicated by valve-module cooling 
caused by hydrazine evaporation. The hydrazine accumulated in an ice state between the valve- 
mounting plates and the gas-generator radiation shield. As entry continued and the lower 
altitudes were reached, flash evaporation ceased, melting began, and the liquid hydrazine ran 
down on to the hot turbine housing surfaces. The ambient pressure in the aft fuselage reached a 
level that would support decomposition at approximately 4 minutes and 30 seconds prior to 
landing. Hydrazine decomposition and subsequent release occurred as indicated by valve 
module heating approximately 4 minutes prior to landing for APU-1 and 2 minutes prior to landing 
for APU-2. Numerous instrumentation and electrical wires on both APUs were damaged by fire. 
The APU-1 shutoff valve electrical current was interrupted, closing the modulation valve which 
caused an APU underspeed condition. The system fuel isolation valve also closed, automatically 
isolating the APU-1 fuel supply. Residual heat from the fire, combined with normal heat soak- 
back, caused the modulation valve and associated tubing to overheat to approximately 500 °F. 
The trapped hydrazine explosively decomposed and the APU-1 modulation valve detonated. The 
detonation caused the APU-1 high-point bleed quick-disconnect poppet to be expelled through 
the flight cap and sent shock waves up the fuel line which detonated fuel vapor bubbles in the fuel 
pump cavity. Additional hydrazine was sprayed into the aft compartment at the time of APU-1 
detonation as indicated by the splash pattern on the avionics bays. Apparently, the shockwave 
from the APU-1 detonation caused the already damaged wires on APU-2 to short, closing the 
modulation valve causing APU-2 to shut down. This resulted in an automatic isolation valve 
closure which isolated the APU-2 fuel supply. The residual heat from the fire combined with the 
normal heat soak-back to cause the APU-2 modulation valve to detonate resulting in a high-point 
bleed quick disconnect blow off and a subsequent fuel pump detonation. 

Inspection of the aft compartment at the APU-1 location revealed minor hydrazine splash in the 
area of the APU mounts and on top of the avionics bays. There was smoke and heat 
discolorations on the insulation and structure forward of the APU and on the exhaust duct above 
the APU. Minor shrapnel damage was noted. 

APU-2 had a splash pattern similar to APU-1, except more extensive. The smoke and heat 
discolorations were evident to a greater degree than on APU-1 and at locations higher above the 
APU. Also, minor shrapnel damage was noted. 

The tear-down and inspection of both APUs revealed that the damage was similar and limited to 
the fuel systems and wiring. Further inspection of the APU injector tubes revealed that both 
tubes were cracked circumferentially upstream of the thermal shunt. 
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The APU stems had intergranular cracks from the inside diameter to the outside diameter for 225 
degrees on APU-1 and 180 degrees on APU-2 around the circumference of the stems. All 
microstructure indicated intergranular carbide precipitation at the inside diameter. The most 
probable scenario describing the cause of the APU stem failure is as follows: 

During the manufacturing operations (braze cycle), a slow cooling of Hasteloy B, which is the 
APU stem injector material, from 2100 °F to 1100 °F resulted in carbide precipitation at the 
material grain boundaries. Additional carbon believed to be available from electro discharge 
machining of the stem bore diffused into the alloy during the brazing operations. A variance in 
cooling rate between the inside diameter and outside diameter during the braze cycle caused 
enhanced carbide precipitation near the inside diameter. The resultant microstructure was 
sensitized, which means that the corrosion resistance of the grain boundaries was reduced. The 
sensitized surface contacted an aggressive environment (hydrazine, air, moisture, carbon 
dioxide, ammonia) with attack accelerated at a region-of-stress concentration due to sustained 
stress levels (injector stem preload caused by manufacturing assembly misalignment). The crack 
progressed until stress levels and/or availability of corrodant changes allowed the fracture to 
finish under mechanical or thermal fatigue conditions. The most suspicious corrodant is carbazic 
acid. The above scenario is considered to be time dependent. The failure mechanism is thought 
to be stress corrosion which requires a susceptible material, an available corrodant, and the 
presence of a sustained surface tensile stress level. 

The APU failures most probably resulted from a crack in the injector stem caused by corrosion of 
the sensitized inside diameter surface. The corrodant is probably carbazic acid or some similar 
substance which can be derived from air, moisture, C0 2 , hydrazine and/or ammonia. The 
corrosion is time dependent and the crack progressed under sustained stress levels from the 
inner diameter surface toward the outer diameter surface until mechanical or thermal fatigue 
conditions could [complete] the crack rupture. ” 



Figure 15-1: APU 1 Fuel Pump Explosion Following STS-9 
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Figure 15-2: APU-1 and -2 in a Nominal Configuration 


Following the STS-9 flight, several changes were made to the APU subsystem, including soaking of the 
carbon seals in hydrazine prior to installation, chromizing the injector stems to prevent corrosion, and 
minimizing stresses on the injector stems during manufacturing and installation. These design flaws are 
believed to be the root causes of the incident. 

Reference: MER Problem Report (STS-9) STS-9-V-26 


16 N 2 0 4 Vapor Release from Loose Fitting (2/17/1984, KSC OPF2) 

On February 17, 1984 there was a small N 2 0 4 vapor release from a loose B-nut fitting in the GSE oxidizer 
vent line in OPF2. There were no injuries or hardware damage; however, OPF2 was evacuated as a 
precaution. It was found that the contractor who originally installed the hardware was careless in their 
installation of several fittings, which were improperly torqued (proximate cause). Once OV-099 rolled out 
for flight from the OPF, all hypergolic, ammonia, and Freon vent system fittings were re-torqued and 
recorded. It was also found that butyl rubber o-rings were installed into some fittings. Butyl rubber is not 
compatible with N 2 0 4 . Following a detailed review of engineering drawings and historical records, all 
suspect fittings were removed and fittings with Teflon seals were installed. Improper configuration 
management was the root cause of this incident. 

The actual incident was not that noteworthy, but there were several improvements made to the GSE, 
configuration control and management, contractor oversight procedures, and OPF area warning system. 
It was found that there was not a proper system in place for a single bay evacuation (OPF1 and OPF2 are 
connected). The single bay clears to date had all been conducted through the area paging system, which 
most personnel in the processing bay either cannot hear or tune out as a result of the large quantity of 
pages that do not concern them. It was also discovered that once the bay had been cleared that it was 
impossible to know if everyone was out of the building. These two items resulted in an OPF area warning 
system with audible alarms (also known as “warblers”) and flashing lights along with the addition of a 
badge board outside the entrance to the bay where personnel are required to place their KSC badge prior 
to entering. This was a substantial improvement in safety. With the new area warning system, personnel 
were able to be notified in the case of a single bay evacuation or dual-bay evacuation. Also, following this 
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incident, there was a strong emphasis placed on detailed contractor surveillance. Prior to the vapor 
release, outside contractors were allowed to install hardware without proper procedures and oversight. 

Reference: Bowman 


17 CCAFS Tanker MMH Fire (5/16/1984, CCAFS FSA 1) 

On May 16, 1984, at Fuel Storage Area one (FSA 1) on CCAFS there was an MMH fire during a tanker 
offload operation. The 3,000 gallon tanker was being drained of its MMH to prepare it for transport of 
Aerozine-50. Approximately 60 gallons had been drained from the tanker into the facility storage system 
while the tanker was at a pressure above atmospheric. The tanker was then purged with GN 2 and vented 
to ambient to allow the technicians to disconnect a flange in the tanker sump (the tank’s low point). The 
flange removal opened the tanker to atmosphere for gravity draining of the residual MMH (about one to 
two gallons) into a stainless steel bucket below, which was being held by one of the technicians. When 
the flange gasket came loose from the tanker, the two technicians noticed the presence of heat on their 
hands and arms through their SCAPE suit gloves. One SCAPE technician declared that there was a fire 
over the communications network and on his way to the safety shower he activated the facility water 
deluge system. 

Once the SCAPE personnel were sure they had extinguished the flames on their suits, they evacuated 
the area to the south. Both had received minor burns on their hands and were sent to a medical facility. 
It was later noted that both SCAPE suits showed signs of burning when they were examined following the 
incident. Shortly after the technicians entered the showers, two fire and rescue personnel who were 
waiting on standby, entered the area and aided the water deluge in extinguishing the flames with their 
charged hoses. It was reported that the fire was completely extinguished in about one minute. 

Following the incident, there was an extensive inspection of the tanker and surrounding areas. It was 
found that the fire was mainly concentrated around the shroud, which covered the sump flange, and the 
stainless steel bucket. An exact cause of the fire was unable to be determined; however, several 
possibilities exist. The following is a tabulated list of possible causes of the fire: 

• There was an extensive amount of corrosion (iron oxide) around the sump drain flange 

• The bucket was not properly inspected and cleaned of any possible iron oxides or other 
contamination prior to running the procedure 

• The bucket could have heated up from solar radiation (the weather for May 16, 1984 was a high 
of 80 °F and a low of 69 °F) 

• There was a potential for a static charge buildup from the falling column of liquid 

o It was reported that the tanker was grounded properly 

o The stainless steel bucket used to drain the residual amount of MMH was not grounded 

• There was non-compatible rust-proofing undercoating on the wheel fenders of the tanker 

• The method of the flange removal was suspect 

o One bolt was left in the flange allowing it to rotate out of the flow path freely while 

spraying MMH in a fan-like pattern increasing the surface area wetted by liquid MMH and 
introducing large amounts of MMH vapor into the air 

It is unknown whether the fire started on the tanker structure or in the bucket. The SCAPE technician did 
state that he did not feel the heat on his hands until after the residual MMH had been emptied from the 
tanker into the bucket. Draining of fuel without knowing that an ignition source was present was the 
proximate cause of the incident. Improper configuration management (maintenance of the hardware to 
prevent the buildup of rust) and an improper training of personnel (flange removal) are noted as the root 
causes of this incident. Following the fire, improvements were made to the fuel storage area water 
deluge system and the fuel tanker trailers. More safety showers were also added to the storage area. 

References: McCoy; Washburn 
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18 Liquid Trap in Purge Adapter Flexhose MMH Spill (5/24/1985, KSC OPF1) 

On May 24, 1985, while preparing for the removal of R4D (down-firing thruster on the Space Shuttle right 
pod) from OV-099, there was an MMH spill in OPF1 on the 10-foot level west side. R4D was being 
removed as a result of an in-flight anomaly related to a heater failure on the thruster. The manifold had 
been drained of its propellant and it was thought that a purge through the MD348 line (which connects to 
the manifold) and out the thruster nozzle purge adapter was sufficient to remove the liquid and most of 
the fuel vapors. Figure 18-1 shows a purge adapter in a cutaway of a primary thruster nozzle. During the 
part of the procedure where the purge adapter was being removed, approximately one cup of liquid MMH 
spilled from the thruster and down onto the body flap (which is illustrated relative to thruster R4D in Figure 
18-2). The body flap was partially covered with spill protection sheets. The OPF1 hypergol exhaust fans 
were activated and the facility was immediately evacuated. It was recorded that some of the liquid MMH 
had saturated the body flap tile filler bar. It is unknown if the tile had to be removed. Unlike N 2 0 4 , which 
was known to breakdown Koropon primer (from the STS-2 N 2 0 4 spill mentioned previously), the effect of 
MMH on Koropon was not well known in 1985. 



Figure 18-1: Space Shuttle Thruster Chamber Cutaway with Purge Adapter Installed 



Figure 18-2: View of Bottom of Right Pod with Orbiter in OPF 
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There are three possible proximate causes to this spill. A combination of two or more of the following 
causes is also possible. The first involves an improper configuration in which the flexhose that was being 
used for the procedure had previously been utilized for a similar operation on the left pod thruster LIU’s 
manifold. This flexhose was several feet longer than the flexhose that was normally used for the right pod 
manifold evacuations. It was routed from the R4D thruster purge adapter to the 19-foot level above, then 
down to the eductor on the 10-foot level. This excessive length in hose may have allowed for a “u- 
shaped” low point trap to be formed in which liquid MMH could have collected. The second possible 
proximate cause involved a procedural error made by the engineers on console. The evacuation could 
have created a pressure differential across the liquid MMH. When the eductor was deactivated and 
removed, this pressure differential may have pushed the liquid into the thruster chamber. The third 
possible proximate cause was the liquid had collected in the thruster chamber (see Figure 18-1) and the 
purge was of insufficient duration to remove all the liquid MMH or the liquid trap may have prevented the 
vacuum source from evaporating all the residual fuel that remained around the purge adapter. A 
definitive proximate cause was never determined. 

Eight personnel in the area of the spill received minor injuries from the inhalation of MMH vapors. 
Following the spill and cleanup, the thruster was successfully removed at KSC, sent to and repaired by 
the manufacturer (Marquardt Corp.), and then reinstalled in the same location on the right pod of OV-099. 

It appears that this spill could have been prevented if the proper hardware had been chosen for the 
procedure. Items of this nature should, ideally, be addressed in the written procedure. Part numbers, 
purge specifics, and toxic vapor check (TVC) sampling techniques should have been specified for the 
operation. Improper procedure control and authoring are the root causes of this incident. 

References: KSC SSP PRACA Database (RP01 -9-08-0031); 1985-144-00001; Heinrich 


19 STS-61C OV-102 SRB HPU Loading N 2 H 4 Spill (12/8/1985, KSC Pad 39A MLP 
Surface) 

On December 8, 1985, approximately three gallons of N 2 H 4 spilled from a Leer-Romec AHC on the SRB 
HPU system. It was later found that the AHC nipple was unthreaded from the AHC body because the 
nipple-to-cap threads had seized. Therefore, the technician in SCAPE was spinning off the GHC/AHC 
assembly from the propellant line that was online to the HPU propellant tank and bulk propellant rather 
that unthreading the GHC from the AHC (proximate cause). There was not a fire and the orbiter 
(Columbia) was undamaged. The SRB was also undamaged. Most of the liquid fell into the flame trench 
about 75 feet below. The N 2 H 4 that collected on the MLP surface was wetted with a fine spray of water 
shortly after the spill. The high temperature for December 8, 1985 was 72 °F. If the temperature had 
been much greater and/or any rust was present on the hot mobile launch platform (MLP) surface, ignition 
of the hydrazine would have been more probable. At the time of the spill, Challenger was on Pad 39B 
awaiting the launch for STS-51L. The first flight of the Space Shuttle with the AHC anti-rotation devices 
installed on the SRBs was the STS-26R return to flight mission after the Challenger disaster. Improper 
vehicle design is the root cause of this incident. 

Reference: KSC Hazard Report (SPC-K1 31 67-86 Rev. B) 


20 Inadvertent Dry Well Removal MMH Spill (1/21/1986, KSC Pad 39A Fuel Farm) 

On January 21, 1986, a technician removed a temperature transducer dry well assembly from the three- 
inch MMH return line at the Pad 39A fuel farm. This was followed by a 12-foot high geyser of MMH from 
the open three-inch line. MMH contacted the left side of the technician’s face and his left forearm. He 
went immediately to the safety shower then onto a local hospital once he was evacuated. He was 
diagnosed with 1 st degree chemical burns on his face and 2 nd degree chemical burns on his forearm. It 
was estimated that approximately 100 gallons of MMH liquid and/or vapor was released. The seven 
technicians located at the fuel farm (some completing other unrelated tasks) immediately evacuated the 
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area. Moments later, two technicians reentered the area from an upwind direction to activate the firex 
deluge system. It is very likely that this prevented a large fire. The technicians did not know that the 
deluge system could be remotely activated from the LCC by contacting them over the Operational 
Intercommunication System (OIS) or by calling 911. A fire would have likely occurred immediately if the 
temperature had been a normal Florida summer day; however, it was mid-winter and the outside 
temperature was 63 °F. 

This incident took place during an annual calibration of temperature transducers and other components, 
using an OMI. The technician was correctly informed by the engineer on console to remove a specific 
temperature transducer from the MMH return line. The technician mistakenly removed the dry well and 
temperature transducer assembly (shown in Figure 20-1) rather than the temperature transducer alone 
(proximate cause). If the temperature transducer was removed properly, there would not have been a 
spill. The following is a quote from the mishap report that explains the incident: 

“The LSOC hypergolic mechanical technician actually performing the task of transducer removal 
used incorrect shop practice and loosened the wrong nut. Instead of using a one-inch wrench to 
retain the dry well in place while loosening the transducer lock nut that threads into the dry well, 
he used the wrench to loosen the dry well. He then used his hand to unscrew the transducer 
thinking he was extracting the transducer from the dry well while he was actually unscrewing the 
transducer dry well assembly from the three-inch MMH line. A mixture of fluid and vapor MMH 
immediately erupted from the line sending a column 10 to 12 feet in the air. ” 



Probe Sensor 



Later the engineer on console told technicians to empty the drainage sump at the fuel farm. This 
ultimately led to contamination of a large area of standing water around the fuel farm. 

It can be stated that this incident should have never happened because the GSE should have been 
vented and drained of all the residual MMH; however, the inherent design of the dry well assembly was to 
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prevent breaking into a hazardous system thus allowing for a reduced level of PPE and risk of an 
incident. Granted, the design of the dry well could have been improved by adding a retainer to prevent 
the entire transducer and dry well assembly from being removed together (a root cause). The primary 
root cause of this incident was lack of training of technicians. Engineers have to depend upon 
technicians to make the correct decisions at some point; otherwise the controls to prevent an incident (in 
attempt to reduce the risk to nearly zero) become so cumbersome that they hinder the actual operation, 
let alone the additional cost of such controls. This is a good example of a case in which engineers had to 
make a judgment call as to the level of PPE and system configuration. With the dry well design in mind, 
the judgment call appears to have been valid. 

There were many lessons learned from this incident. These include: 

• Dry well retainers are needed and are now used on all hypergolic propellant dry wells 

o This design flaw in the GSE is considered a root cause 

• T raining of technicians for proper removal of components needs to be scrutinized 

o This is considered the root cause 

• The system tubing was not properly vented to ambient prior to the spill resulting in a 6 psia driving 
pressure behind the liquid MMH (a proximate cause) 

o Hypergol systems are usually left with a blanket pressure to prevent air intrusion and 
should not be required to be vented for this type of transducer replacement 

• The system tubing had not been completely drained prior to running the transducer replacement 
operation (a proximate cause) 

o Draining of residual propellant should not be required for a transducer replacement as a 
result of the dry well 

• The procedure was considered non-hazardous; therefore, the PPE was not at a level in which 
one would don for entry into a hazardous system 

o It was believed that the hazardous system would not be compromised by removal of the 
transducer 

• Proper testing of the spill area for contamination should be completed prior to emptying the sump 
tanks to grade 

References: Cotton; Sargent; 1986-021-00001; Heinrich 


21 Relief Valve R&R Oxidizer Farm N 2 0 4 Vapor Release (7/29/1986, KSC Pad 39A) 

On July 29, 1986, there was a large N 2 0 4 (N0 2 ) vapor release from the storage tank at the Pad 39A 
oxidizer farm. The event was somewhat planned; however, it was not anticipated that the final quantity of 
the release was going to be as much as what occurred. Prior to 1986, when the storage tank relief valve 
was required to be removed and replaced annually, it was accepted that there was going to be a release 
of approximately one gallon of N 2 0 4 (N0 2 ) vapor as a result of the removed relief valve tubing being 
online to the storage tank ullage and open to atmosphere. The estimated vapor release following the 
removal of the relief valve in this instance was approximately 28 gallons. 

Prior to the relief valve removal, the oxidizer storage tank was vented down. Removal operations began 
immediately following the venting; therefore, the propellant in the storage tank was not given the proper 
time to cool to below vapor pressure. There was still approximately 5 psig of pressure in the storage tank 
(which was visible from the remote console in the LCC) at the time of the valve removal (a proximate 
cause). 

Another proximate cause of the larger-than-expected release was the tearing of a SCAPE technician’s 
suit. He was trying to install the new valve while the storage tank was violently venting oxidizer vapors 
(as a result of the large backpressure that remained in the storage tank), when his suit brushed against a 
nearby sharp object. He proceeded to leave the area when he noticed the tear in his suit. This delayed 
the installation of the new relief valve until a new group of SCAPE technicians arrived at the oxidizer farm. 
It was reported that the cloud “exceeded the pre-designated clear area of 700 feet downwind” exposing 
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several personnel to the toxic vapors. The venting oxidizer vapor eventually cooled the liquid in the 
storage tank from the boil-off. This significantly decreased the violence of the heavy vapor venting. 

Along with the first technician who tore his SCAPE suit, two other technicians were exposed to oxidizer 
vapors. One noticed yellow stains on his undergarments following the removal of his SCAPE suit. The 
other reported burns on his right hand later in the day. All the exposed technicians were sent to the KSC 
Occupational Health Facility (OHF) and released back to work within a few hours. 

An improper GSE design and operational human error were the root causes of this incident. About ten 
months prior to this relief valve removal and replacement operation, a formal request had been submitted 
by engineering to install a dual relief valve system onto the storage tank with a three-way isolation valve 
to prevent a vapor release during component removal. This request was denied. Following the large 
vapor release, the modification was implemented at both launch pads, greatly reducing the possibility of 
any future hazard. This dual relief valve modification allowed for isolation during the relief valve annual 
maintenance. The modification was also implemented on the fuel storage tanks at both launch pads. 
Figure 21-1 is a photograph of the relief valve locations on the top of the N 2 0 4 storage tank with a close- 
up photograph of the relief valve three-way isolation valve modification. 



Dual Relief Valve 
Modification on Top 
of N 2 0 4 Storage Tank 
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Figure 21-1: Dual Relief Valve Modification Location 


References: KSC Hazard Report (SPC-K1 21 86-85); 1986-210-00001; Heinrich 


22 OPF2 Trench N 2 H 4 Spill and Fire (9/19/1986, KSC OPF2) 

During an APU hydrazine (N 2 H 4 ) tank drain on September 19, 1986, there was a spill and fire in the OPF2 
water deluge trench. The fire was caused by a small amount of hydrazine (about 14 gallon) leaking from a 
fitting in the GSE vent system into the deluge trench and reacting with debris or residual chemicals 
(proximate cause). The fire was isolated to the trench. The SCAPE technicians extinguished the flames 
using a nearby fire hose. 

Improper configuration management was the root cause of this incident. After the fire, it was found that 
an o-ring was missing from the outlet adapter fitting at a check valve in the vent system allowing an 


Page 34 


NASA/TP-2009-2 14769 


external leak. It is assumed that the vent system was free of residual propellants since it was purged at 
35 psig; however, since the vent had been utilized during the drain, some residual fuel remained in the 
lines. The following is a list of observations related to this incident: 

• Cleanliness levels in the areas surrounding hypergolic operations must not be ignored 

o The OPF water deluge trench was not routinely cleaned or inspected 

• The toxic vent system was not leak checked routinely; however, vent systems are not usually leak 
checked because they cannot be completely pressurized 

• Care needs to be taken when installing components in hypergolic ground support equipment 

Reference: Johnson 


23 N 2 O 4 and Insulation Adhesive Small Fire (6/23/1988, KSC Pad 39B Oxidizer 
Farm) 

On May 25, 1988, at the Pad 39B oxidizer farm, technicians were completing an N 2 0 4 sampling 
operation. During the operation, the technicians detected a small leak at the interface between the 
sampling valve and the tubing (see Figure 23-1). The sampling operation was delayed until the leak 
could be fixed. The repair was finally scheduled to be worked about a month later during the afternoon of 
June 23, 1988. The removal of some local insulation was required to fix the leak along with re-torquing 
the fitting that connected the sample valve to the tubing. This was all completed that afternoon. 



Figure 23-1: Photograph of Sample Port 


At about 10:30 PM on June 23, 1988, the sampling operation was successfully repeated. This was 
followed by the disconnection of the sampling flexhose from the sample port. When the flexhose was 
removed, liquid N 2 0 4 spilled (about two tablespoons) into the small well surrounding the sample port. It 
was not uncommon to have a small amount of residual N 2 0 4 remaining in the sample flexhose when it 
was disconnected. The spilled N 2 0 4 reacted with the adhesive used for the attachment of the insulation 
to the tubing and ignited (proximate cause of the fire). The fire burned itself out in about 10 to 15 seconds 
before the technicians in SCAPE could return with a fire hose. There were no injuries to the personnel 
working the operation and the only hardware damage was to the insulation, which was replaced. 

The insulation had been installed within hours of the sampling procedure; therefore, it was not given the 
appropriate time to fully cure. The adhesive used to attach the insulation to the tubing was found to 


Page 35 


NASA/TP-2009-2 14769 


contain volatile hydrocarbons. This allowed for a chemical reaction to take place between the adhesive 
and N 2 0 4 , causing ignition. The root cause of this incident was operational human error as a result of not 
allowing the insulation adhesive to fully cure. 

Reference: KSC SSP PRACA Database (PR PADB-0209) 


24 STS-26R OV-103 N 2 0 4 Tubing Leak on Vehicle (7/14/1988, KSC Pad 39B) 

On July 14, 1988, about three days after the loading of N 2 0 4 onto Discovery at Pad 39B for the STS-26R 
Return to Flight mission, a small N 2 0 4 (N0 2 ) vapor leak was detected in the left OMS pod (LP04) of 
Discovery. STS-26R was the first flight following the Challenger disaster on January 28, 1986. The leak 
did not result in any injuries or hardware damage, but it did impact the launch date of Discovery. Along 
with several other Return to Flight actions, the launch team at KSC was required to test fire the three 
main engines on Discovery while it was at the launch pad. This was known as the Flight Readiness 
Firing (FRF) and was scheduled to occur on July 26, 1988. The Space Shuttle Program decided to 
complete the FRF regardless of the known oxidizer vapor leak; therefore, the engineering team assigned 
to assess the leak had a couple weeks to study possible solutions, while other groups were preparing for 
the FRF. 

First, the exact location of the leak within the pod had to be found (a cutaway view of the Space Shuttle 
OMS pod can be seen in Figure 24-1). This was difficult because the internals of the aft pods and 
forward module are not meant to be accessed while the vehicle is at the launch pad. The location of the 
leak had been isolated to the LRCS N 2 0 4 system or the associated tubing through monitoring of the 
instrumentation in the LCC. The leak was measured to be 0.26 psi per hour (about 800 standard cubic 
centimeters per hour) and a TVC found the concentration of N0 2 vapor to be 15 ppm at the vehicle vent 
door. This later decreased to 3 ppm. An access door was removed on the pod’s outer skin and several 
internal thermal blankets were removed. A long section of PVC pipe was then inserted into the pod to 
function as a guide for a borescope. Using a borescope, the leak was finally isolated (after a six hour 
search) to a /4-inch dynatube fitting on the MD224 leg (the N 2 0 4 propellant tank ullage vent). A cross- 
section view of a dynatube is shown in Figure 24-2 and a photograph of the leak location can be seen in 
Figure 24-3. 



Figure 24-1 : Cutaway View of Space Shuttle Orbiter Aft 
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Figure 24-2: Cross-Section of Dynatube Sealing Surface 



Figure 24-3: Dynatube Location on ARCS N 2 0 4 Tank 


The engineering team came up with the following solutions to resolve the leaking dynatube: 

• Fix the leak at the launch pad (this had never been attempted before due to access issues) 
o Cut a hole in the aft bulkhead structure (1307 bulkhead) and top of OMS/RCS pod 

- Put a “clamshell” around the fitting and inject a sealing compound into it, or 

- Drain the N 2 0 4 propellant tank, disconnect and polish the dynatube, or 
■ Cut out and replace the dynatube fitting with a new one 

o Send a “stopper” up the line from the QD to plug the line (35 to 40 feet of tubing) 
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• Return the vehicle to the VAB, de-stack, and swap LP04 with LP01 from Atlantis in the OPF 

o The orbiter aft pods are not able to be removed and replaced at the launch pad since the 
removal and handling equipment does not exist for this type of operation and the pods 
are obstructed by the MLP tail service mass (TSM), shown in Figure 24-4 

• Return the vehicle to the VAB, de-stack, remove LP04 from Discovery in the OPF, send the pod 
to the HMF to be repaired, and re-install it onto Discovery once the repairs had been completed 

o This would delay the launch about two months 

• Fly with the leak and fix it following landing 



Figure 24-4: Location of Left Pod on Space Shuttle 

After a week of deliberation, the “clamshell” was selected as it was the least invasive method to stop the 
leak prior to launch and it could be completed at the launch pad. Furmanite FSC-6B was used as the 
sealing compound as a result of it having the best compatibility characteristics with N 2 0 4 . The FRF was 
finally completed on August 10, 1988 following a few hardware-related delays. The repair of the oxidizer 
vapor leak began on August 17, 1988 with the cutting of two holes in the aft 1307 bulkhead (the bottom of 
the payload bay with the orbiter in the vertical orientation) and the top of the pod beneath the bulkhead. 
The dynatube’s safety wire was removed and a “clamshell" (shown in Figure 24-5) was placed over the 
leak. The Furmanite sealing compound was then injected. The leak was eliminated; therefore, the Space 
Shuttle Program cleared Discovery for launch, which successfully occurred on September 29, 1988, a few 
weeks later than the original launch date of September 6, 1988. The delay was a result of multiple items 
including the FRF test delays, return to flight SRB testing delays in Utah, and the N 2 Q 4 leak on LP04. 
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Photo Credit: Florida Today 
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Figure 24-5: Technicians Repairing STS-26R Leak at the 1307 Bulkhead 

The proximate cause of the leak was found to be a scratched dynatube. This was discovered during 
ground processing two missions later when the pod was removed in the OPF and sent to the HMF for 
repair. It was determined that the scratch must have occurred either when the dynatube was 
disconnected in October of 1987 to allow access to a nearby valve for a removal and replacement or 
when it was reconnected in late December of 1987. Following the reconnection, the dynatube fitting 
passed all leak checks. Transport vibrations may have “altered” the state of the connection between the 
HMF, OPF, and launch pad; however, this is highly unlikely since dynatubes do not typically change 
mechanical state, especially with safety wire installed. The Kersey report states that “The most probable 
cause was that the mass spectrometer probe operator probed the wrong RCS propellant system (i.e. 
MMH instead of N 2 0 4 ).” Operational human error was the root cause of this incident along with improper 
training. This categorization was given as a result of the incident being a consequence of either an 
inadequate inspection of the dynatube sealing surface or an error made during the leak check of the 
dynatube. 

A question was raised concerning the accuracy of the mass specification leak check, which was the leak 
detection method used on this dynatube in December of 1987. As a result, a new policy was 
implemented to independently verify zero leakage using two separate methods. Currently, the Space 
Shuttle hypergol systems utilize a hazardous vapor (“sniff) leak check, in addition to the mass 
specification leak check of individual fittings when they are disconnected for any reason. 

The Kersey report also lists the following as findings and recommendations to reduce the risk of an 
undetected dynatube leaks in the future (below some items are resolutions to the findings or 
recommendations): 

• Findings and Recommendations: 

o The system decay check may not have detected this leak. 

o Increased discipline is required at the HMF in the use of OMI’s, Job Cards, and the 
PRACA [Problem Reporting and Corrective Action] system. 

■ A new OMI was developed along with a Quality Awareness Bulletin to ensure 
problems are properly documented. 

o Training was less than adequate. 

■ A new Dynatube Connection and Inspection course was created and added to 
the technician’s certification plan along with updating the existing courses. 
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o The existing mass spectrometer units are complex to operate, outdated, and vulnerable 
to transportation damage. 

■ Six new Leybold mass spectrometer units were procured. 

o Perform mass spectrometer leak tests of all joints in lieu of rough pressure decay checks, 
when systems have been decontaminated/cleared of hypergolic propellants. 

o Revise procedures to include data sheets, requirements, calculations, and equipment 
verifications to assure accurate and consistent data is recorded for mass spectrometer 
leak checks. 

- Procedures were revised. 

o Procure new tools, develop repair standard and inspection procedures to the latest 
criteria, and develop a standard training certification program for all personnel working 
with dynatube fittings. 

- Two new repair kits were procured. 

■ Standard OMI’s were developed for dynatube inspection and repair. 

■ The inspection specification was updated with specific criteria. 

■ A formal certification was established for working with dynatube fittings. 

o Form a well-trained and dedicated mass spectrometer maintenance team authorized to 
do repair work. 

■ An engineering “focal point” was established for controlling all efforts with 
dynatube fittings. 

References: Delventhal; Banke; Glisch; Fisher; Kolcum; Draus; Kersey 


25 WSTF Fuel Waste Flash Fire (2/16/1990, WSTF) 

Following a fuel (it is unclear if it was N 2 H 4 or MMH) operation at WSTF, a portable fuel aspirator was 
being drained into a 6,000 gallon fuel treatment tank. The aspirator tank contained approximately 40 
gallons of liquid (5% fuel and 95% water). At the time the treatment tank contained approximately 600 
gallons of water, 25 lbs of calcium hypochlorite, and 10 lbs of caustic. The aspirator was gravity drained 
into the treatment tank and then flushed with approximately 200 gallons of water. Approximately 25 lbs of 
HTH chlorine was then added to the top of the treatment tank causing an immediate reaction and a flame 
approximately 1 5 feet into the air above the tanker hatch (proximate cause). The fire went out after a 
second or two. There were no reported injuries or hardware damage as a result of the fire. Safety 
personnel recommended that the water content of the treatment tank be doubled and a sample of the fuel 
content be taken. It was found that the fuel content was 1.3% after the water had been added (recall that 
a 65% water to 35% fuel mixture is sufficient to prevent a fire). The fire was likely a result of fuel vapors 
present in the tank ullage volume. Operational human error is the root cause of this incident as a result of 
the technician creating a fuel vapor rich environment during the emptying of the aspirator tank; although, 
preventing this would have been difficult. 

One possible cause of the fire is the NaOFI(aq) + HCI — *• NaCI + Fl 2 0 reaction, which is highly exothermic. 
It is possible that residual MMH or N 2 H 4 dissociated from solution while flowing into the containment tank 
and collected in the ullage to later ignite from the heat generated by the addition of the HTH into solution. 
This, however, has not been proven. 

Reference: Henderson 


26 Aspiration of N 2 0 4 into Fuel Vent System (3/26/1990, WSTF TS 401) 

On March 26, 1990 at Test Stand (TS) 401, a fuel (MMH) aspiration flexhose was mistakenly connected 
to the N 2 0 4 manifold service valve, SV12, instead of the fuel manifold service valve, SV11. There were 
incorrect identifications etched on the metal plate above each valve (proximate cause). The valves 
themselves had the correct color-coded plastic tags attached; however, following the test firing of a 
nearby engine, the tags had melted and fallen off as a result of the excessive heat. 
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When the service valve SV12 (incorrectly labeled as SV11) was opened, hypergolic reactions began to 
take place in the fuel aspirator flexhose and downstream vent lines. The oxidizer manifold pressures 
dropped from 80 psia to 22 psia and the technicians noted that the flexhose was warm to the touch. The 
service valve SV12 (really SV11) was immediately closed. Later, the flexhose was removed and flushed 
with water along with the fuel aspirator. It was approximated that a maximum of 2 tbsp of N 2 0 4 may have 
been aspirated. The technicians noted some discoloration in the flow direction identification tape on the 
fuel aspiration lines. It is thought that most of the reaction took place in the flexhose and first 25 feet of 
the TS 401 facility line. 

Improper configuration management (improper labeling of components) was the root cause of this 
incident. Some possible improvements to the test setup include keying in the N 2 0 4 and MMH fittings to 
preclude mismatching and improved labeling and redundant labeling of components. 

Reference: Meyer 


27 HMF Screens Test Drum MMH Spill (12/7/1990, KSC HMF M7-961 East Test 
Cell) 

During the first aft reaction control system (ARCS) propellant tank screens test at KSC’s HMF M7-961 
East Test Cell on December 7, 1990, roughly one to two gallons of liquid MMH spilled from the relief 
valve of a 55 gallon MMH drum and onto the floor of the test cell. The amount of liquid MMH, sufficient to 
cover the lid of the 55-gallon drum, represented a significant surface area once it spilled to the HMF cell 
floor. Experience and research have shown that the likelihood of an MMH flash fire is directly 
proportional to its surface area. It was fortunate that this incident did not result in a fire, which likely did 
not occur as a result of the conditioned air in the test cell being about 70 °F and the floor area being clear 
of any iron oxide. Once the source of the leak was determined, the manual fill valve was closed, the 
drum was pressurized, and the liquid was drained back into a nearby tanker trailer. 

It was determined that a hard-line hose from a technician’s SCAPE suit caught on a manual fill valve 
handle and opened it, filling the drum from the tanker (proximate cause). The handle was sticking out 
beyond the edge of the panel. Following the spill, the handle was removed and rotated 180 degrees so 
that it no longer protruded beyond the edge of the panel. Entry into the cell was not allowed for several 
days since some of the liquid MMH ran into areas that were not easily accessible. The root causes of this 
incident were improper GSE design (protruding handle) and human error (lack of technician situational 
awareness). One must consider, however, that a technician’s visibility in a SCAPE suit is poor, especially 
peripheral vision. 

References: KSC SSP PRACA Database (PR C72-1 631 -03-001 -001 5 and PR HMFE-0299) 


28 STS-42 OV-103 Ferry Plug Removal MMH Spill (2/12/1992, KSC OPF3) 

Following the STS-42 mission and ferry flight of Discovery from EAFB on February 12, 1992, 
approximately !4 to % cup of MMH spilled from a RCS thruster nozzle. This occurred when the ferry plug 
was removed in OPF3 (proximate cause). The liquid contacted the gloves and right shoe of the 
technician who was removing the plug. There was no reported hardware damage. The collection of 
liquid in the thruster was believed to be a result of cold temperatures causing the thruster valve to leak 
(see section 14). The vehicle was not powered during at least one stopover for refueling of the SCA; 
therefore, the thruster heaters remained off. At this point in the Space Shuttle Program, the limitations 
and sensitivities of the thruster valves were well understood. The root cause of this incident was 
improper design as a result of not implementing provisions to provide ground power during the SCA 
stopover. 

Reference: RCS Thruster Heater Power during Ferry Flight Stopovers; Heinrich 
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29 WSTF Incorrect Flight Cap N 2 0 4 Exposure (11/4/1992, WSTF) 

While installing flight caps on the OMS ground test article at WSTF on November 4, 1992, a technician 
attempted to install a Vi-inch AHC cap to a 14-inch AHC. The technician was subsequently exposed to 
liquid N 2 0 4 and suffered minor chemical burns on his hands and forearm. Both the 14-inch cap and 14- 
inch cap have a protrusion that acts as a secondary seal when installed on the AHC. The 14-inch AHC 
cap protrusion is 0.235-inch longer than the 14-inch AHC cap protrusion (see Figure 29-1). This additional 
length is enough to actuate (depress) a 14-inch AHC poppet if the proper force is applied to the 14-inch 
cap (proximate cause). The only action to reduce the possibility of a similar event occurring in the future 
(short of a redesign) was more extensive training and certification of the technicians; therefore, this was 
considered a root cause for this incident along with operational human error and improper vehicle design. 
Other lessons learned and findings include: 

• The appearance of a 14-inch AHC cap is such that it could be mistaken for a 14-inch AHC cap to 
an untrained technician 

o The technician was undergoing on the job training under the direct supervision of an 
experienced technician, but the distinction between a 14-inch cap and a 14-inch cap was 
not explained to him 

• Age and wear made part number identification on the AHC cap difficult 

• Work instructions should be written to include positive identification of interface equipment 

• AHC cap mating should not be considered a benign activity; therefore, PPE should be used to 
protect the employees from credible releases of propellants 

• Future designs should consider keying of AHC caps to preclude incorrect size/commodity 
installation 



Figure 29-1: 14-inch and 14-inch Hypergolic Flight Cap Cutaway View 


Reference: Reynaud 


30 Thermochemical Test Area N 2 0 4 Vapor Release (4/21/1994, JSC Building 353) 

On April 21, 1994 at the JSC Thermochemical Test Area (TTA) Building 353, there was a large N 2 0 4 
vapor release at approximately midday. Engineers and technicians were preparing for a simulated 
altitude test of a small bi-propellant rocket engine. Oxidizer was first flowed in the system on February 
22, 1994; however, a few leaks were noted and the system was drained and refilled twice following 
troubleshooting of the noted leaks. During the thruster firing procedures on April 21, 1994, a three-way 
solenoid valve failed allowing liquid N 2 0 4 to leak into the vent line and oxidizer burner stack (proximate 
cause). It was later determined that the valve had an extra one-half of a Teflon seal, extensive corrosion, 
and some small scratches on the armature. It is unclear which particular item caused the valve to leak, 
but the most likely candidate was the extra one-half of Teflon seal. 

The test team was unaware of the valve failure and continued on with their procedures. They first 
brought up pressure in the oxidizer tank to approximately 850 psig, which was greater than the desired 
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pressure of 800 psig. The solenoid valve leak rate then increased filling the burner stack with N 2 0 4 liquid 
and vapors. The over-pressurization required the test team to vent approximately 50 psig off of the 
system. When they proceeded with the venting process, a small amount of oxidizer vapor exited the 
burner stack. This was an indication that there was a problem with the system; however, the test team 
proceeded on while rationalizing the small oxidizer cloud as an incorrect methane burner supply valve 
setting. 

The test team decided to continue on with their procedures even though there was an inadvertent oxidizer 
vapor release and some data in the control room was indicating possible issues with the system. It is 
unknown if the test team simply did not notice the data or they misinterpreted it. A short amount of time 
passed while the test team assessed the situation allowing the oxidizer tank pressure to drop (as a result 
of the leaking three-way solenoid valve) to 600 psig. The test team failed to notice the significance of the 
200 psi pressure drop and proceeded to increase the oxidizer tank pressure again to approximately 800 
psig. When they did this, there was a large N 2 0 4 (N0 2 ) vapor release from the burner stack 
(approximately 16 to 20 gallons of liquid N 2 0 4 and N0 2 vapors). The oxidizer cloud traveled downwind in 
a westerly direction resulting in the displacement of dozens of people. About 81 people (9 NASA 
personnel, 70 contractors, and 2 visitors) received minor injuries from inhalation of the oxidizer vapors. 

The following are contributing factors and/or lessons learned from this incident: 

• A formal emergency response did not exist for this type of event 

o The emergency response personnel at JSC lacked the proper training and practice for a 
hypergol spill, vapor release, or fire at the time 

• The process lacked proper identification of safety control hazards and emergency procedures 

• There were insufficient controls in the system as it contained single point failures (improper 
design; a root cause) 

• The system should have contained a bypass relief valve that could withstand liquid lock (improper 
design; a root cause) 

• Several attempts were made to tighten leaky fittings and clean up liquid oxidizer spills without the 
use of any PPE 

• The test team failed to notice the severity of the events as they were unfolding by either the data 
that was being obtained in the control room or the initial small cloud of N0 2 vapor that was 
released; lack of situational awareness or human error was one root cause of this incident 

• The test team lacked the proper training for dealing with hypergols (another root cause) 

• JSC management was unaware of the risks in preparing for and conducting the test of this bi- 
propellant rocket engine 

• There was a lack of voice and video recording of this operation 

• Facility changes were not processed correctly and were not distributed to the appropriate 
disciplines; improper configuration management was another root cause of this incident 

• KSC management also felt the need to assess their own safety practices following this incident 

o GSE and facility designs, training requirements, emergency response procedures, and 
procedure review practices were reviewed and updated accordingly for all hypergolic 
systems at KSC 

References: Rathgeber; Torpey 


31 Titan IV A K-9 N 2 0 4 Spill (8/20/1994, CCAFS SLC-41) 

On August 20, 1994, at Space Launch Complex 41 (SLC-41) on CCAFS there was a large release of 
liquid N 2 0 4 . Oxidizer was being loaded into the Titan IV A’s solid rocket motor (SRM) thrust vector control 
(TVC) system in preparation for the launch of the National Reconnaissance Office’s Mercury Electronic 
Intelligence or ELINT satellite on August 27, 1994. The N 2 0 4 was used to alter the combustion in the 
Titan IV A SRM nozzle and, therefore, provide TVC. A photograph of the SLC-41 launch pad with a Titan 
IV A is shown in Figure 31-1. A diagram of the Titan IV A’s TVC system is shown in Figure 31-2 with the 
numbered callouts listed in Table 31-1. The incident occurred about three and a half hours after sunrise 
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when the solar heat caused the pressure to increase in the N 2 0 4 tubing while the system was in a static 
configuration. 



Figure 31-1: SLC-41 with Titan IV A (Servicing Structure Retracted) 

The pressure increase went unnoticed by the engineers and technicians. Remote data monitoring was 
available on the launch vehicle, but not on the propellant transfer systems (GSE). Local dial gauges likely 
showed the increase in pressure; however, there were no technicians monitoring these particular gauges. 
The pressure rise eventually caused a weld seam to fail at the base of the transfer system (proximate 
cause). This portion of the N 2 0 4 servicing GSE lacked a relief valve, thus allowing the propellant in the 
tubing to become “liquid locked” since a drain-back and purge had not been completed (improper design; 
a root cause). There was no damage to the GSE (excluding the ruptured tubing) or vehicle hardware and 
there were no reported injuries. 

Usually this tubing would not contain any propellant unless a loading operation was underway; although, 
schedule pressure led to the decision to halt the propellant drain-back and purge following the loading. 
The processing schedule had been delayed by a couple hours as a result of addressing a leak on a fill 
and drain valve on the SRM TVC system. Once the fill and drain valve leak was repaired, other non- 
related, time-critical work required attention on the upper stage of the Titan IV rocket. As a result, the 
Launch Conductor delayed the purge of the oxidizer loading system by several hours since these two 
operations could not be conducted in parallel. Once the upper stage task was completed, the Launch 
Conductor delayed the purge again to allow the engineers and technicians to prepare for the fuel loading 
operation. Fifteen minutes after the vehicle fuel tanks were loaded for flight, the N 2 0 4 GSE tubing 
ruptured. The release amount was approximately 350 to 400 gallons into the launch pad transfer slip. 

Another root cause of this incident was determined to be frivolous procedure deviations. The loading 
team and Launch Conductor had experience with successfully delaying the oxidizer drain-back and 
purge; however, this experience was based on insulated oxidizer tubing. The tubing at SLC-41 had 
recently been removed and replaced with non-insulated tubing as a result of the moisture trapped in the 
insulation causing accelerated corrosion. The loading team and the Launch Conductor either did not 
recall this or they were never told. 

There are requirements for launch Pads 39A and 39B to have seamless pipe throughout and to have 
relief valves in tubing that could become “liquid locked.” Following the incident at SLC-41, the procedures 
were changed to preclude this sort of incident from happening in the future. The procedure deviation 
approval rules were also reaffirmed to the loading team and Launch Conductor. 
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Figure 31-2: Titan IV A TVC System Schematic (see Table 31-1 for references) 


Table 31-1 : Component Callout Descriptions 


Item # Component Item 

1 Injectant Tank 

2 TVC Tank Extension Assembly 

3 GN 2 Fill and Vent Valve 

4 Tank Assembly Base Section 

5 GN 2 Valve Purge System 

6 Quick Disconnect Coupling Assembly 

7 Tank Assembly Support Tie Rod 

8 TVC Tank Extension Shear Fitting 

9 TVC Tank Assembly Fairing 

10 Transfer Tube Support Assembly 

11 Injectant Transfer Tube 

Reference: Rodgers; Skaja 


Item # Component Item 

12 TVC Heat Barrier Boot 

13 Injectant Manifold 

14 Self-Sealing Coupling Assembly 

15 Injectant Valve Housing 

16 Pyroseal Assembly Components 

17 Injectant Valve (FCV) 

18 TVC Distribution Box 

1 9 Power T ransfer Switch 

20 Power Bus Terminal Strip Assembly 

21 Electrical Distribution System 

22 TVC System Storage Battery 
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32 STS-69 OV-105 Left Pod MMH Fire (12/9/1994, KSC OPF1) 

During the STS-69 OV-105 flow, while performing a thruster L3D removal and replacement, an MMH 
flame was reported in the Space Shuttle left OMS pod stinger area (see Figure 32-1 for the relative 
location of the stingers). The technician in SCAPE was preparing to inspect the dynatube (approximately 
an hour after the thruster was removed) with a mirror when he reported a small flame on the MMH 
thruster feedline dynatube. Another technician was unable to find any water to put out the fire and 
mistakenly picked up an alcohol bottle and sprayed the flame which produced a small flash near the 
feedline, igniting the residual MMH inside it. It is believed that the technician thought the spray bottle was 
Freon. It was reported that the flame was extinguished by the technician placing his SCAPE glove over 
the dynatube end. This was probably not the best idea since MMH can react exothermically in a rigid 
volume and burn in an atmosphere 2.5% to 98% by volume in air. 



Figure 32-1 : Stinger Locations on Orbiter 


Prior to the reported fire, the technician removed the Aclar (plastic film) bag from the open end of the 
thruster feedline dynatube fitting. This fitting connects the manifold to the thruster. When he did this, he 
noted that there was an exceptionally large amount of fuel vapor present and some liquid MMH was 
dripping from the open line. The technician proceeded to place the aspirator directly on the feedline 
dynatube (the procedure and known practice was to place the aspirator perpendicular to the dynatube 
exit). This was likely the proximate cause of the fire. The engineer on console then noted that the 
manifold pressure dropped from 16 psia indicated to 6 psia indicated in about five seconds (the 
transducer had a 2 psi offset). The manifold pressure stabilized to 16 psia indicated after a couple 
minutes. At this point, the technician was instructed by the engineer to remove the aspirator from the 
dynatube. He did this and then left the area to find a mirror to aid in the dynatube inspection. When he 
approached the dynatube with the mirror he noted a “cream/yellowish color” flame and “heat waves.” As 
previously mentioned, he proceeded to put out the flame with his glove after the other technician doused 
the area with alcohol. 

The engineer on console was not convinced that the technician had seen a flame because it was his 
belief that MMH fires are not visible or are clear (as noted in section 1.3 Properties of 
Monomethylhydrazine (MMH), MMH flames are usually light yellow in color). He thought that the 
technician had seen some off-gassing of the MMH that was enhanced by a nearby light source; however, 
this cannot explain the flash fire from the alcohol spray. This flash required a flame to already be present. 


Page 46 



NASA/TP-2009-214769 


The engineer voiced his thoughts to management and they trusted his opinions as the system expert. 
The technician who reportedly put out the fire with his glove, later made a statement that he was 
instructed to “not talk about flames or fires over the net” by engineering and technician operations. If this 
did actually occur, it is very unfortunate that the technician was specifically told to not follow the 
appropriate safety protocol in the event of an incident. 

It was later determined through analysis that an MMH decomposition (exothermic) reaction had occurred 
in the thruster feedline and there was likely a flame present. When the aspirator was placed onto the 
dynatube, it removed the inert GN 2 from the line and replaced it with an inrush of air. The residual MMH 
that remained as a thin film around the inner diameter of the tube began to react with the oxygen in the 
air. When the decomposition reaction reached a temperature of 382 °F within the interior of the feedline, 
ignition occurred. A flame will persist until the fuel is exhausted or the oxidizer is removed or exhausted. 
In this case, the glove of the technician’s SCAPE suit removed the oxidizer. 

No damage to the tubing or to other hardware was found during the inspections immediately following the 
fire. The PR closure stated the following as a possible reason for ignition: 

“. . .the ignition was the result of a vacuum being inadvertently placed on the line by a technician 
using a spill aspirator. This vacuum removed the inert GN 2 which was present inside the line. 
When the aspirator was pulled away, it allowed air to enter the line. The air, which contains 
oxygen and carbon dioxide, reacted with the thin layer of fuel [MMH] residue inside the tube. This 
reaction continued until the fuel [MMH] has reached the flammability limit of 382 °F. ” 

Possible annealing of the feedline became a concern. This was addressed in the original PR in which the 
closure stated the following: 

“...assuming the worst case where the tubing was annealed during the fire, the maximum 
pressure (approximately 1200 psia) the line could have possibly seen was well below (less than 
50%) the yielded strength of 5/8-inch diameter, 0.028-inch thick 21-6-9 cres [corrosion resistant 
steel] tubing in an annealed condition. ” 

This event displayed a break-down on many levels including: 

• The technicians were improperly trained (aspirator directly on dynatube) 

o Improper training was one root cause of this incident 

• Operational procedures did not adequately safe the system for hazardous operations (a root 
cause) 

• The engineer was not cognizant that an MMH fire has a light yellow flame and is very likely to 
ignite under the right conditions (decomposition reaction) 

• The technician was told not to discuss an emergency-type situation on the communications net 

• A charged water hose or water source was not nearby during the operation 

References: Applewhite; Weber 


33 STS-69 OV-105 Right Pod MMH Fire (5/4/1995, KSC OPF1) 

During the STS-69 OV-105 flow, while performing a thruster R1A removal and replacement, a fire broke 
out in the Space Shuttle right OMS pod stinger area. The fire burned strongly for about 30 seconds and a 
smaller flame burned for about one minute and 45 seconds. The size of the flame was estimated to be 
approximately 15 inches x 11 inches x 11 inches with a damage region of approximately 22 inches x 14 
inches x 14 inches in the stinger. The materials that burned included several ounces of fuel, a shop light, 
and the Orcofilm spill protection (flame retardant covering films). Figure 32-1 is a still image from the 
video recording during the fire and Figure 33-2 is a clearer color photograph of the same area for 
reference. 
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Figure 33-1: Still Photograph from Video of RP01 Fire 
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Figure 33-2: Color Photograph of Right Pod and Orbiter Aft 
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A technician in SCAPE was disconnecting the R1A thruster MMH feedline dynatube during a thruster 
removal and replacement procedure. The procedure was initiated following an in-flight anomaly that 
occurred on the thruster during on-orbit operations (R1A primary thruster failed off due to a low chamber 
pressure). The N 2 0 4 dynatube had already been disconnected and double-bagged in attempt to contain 
the residual vapors that were being released from the fitting. The technicians were told to place an 
aspirator near the N 2 0 4 dynatube and proceed with the fuel feedline disconnect operation. When the seal 
of the fuel dynatube was broken by the technician using a wrench, he noted that there were “large drops 
of fuel being siphoned away by the aspirator." Immediately following this, a fire erupted. There were six 
SCAPE personnel in the area when the fire was first reported. The proximate cause of this incident was 
the disconnection of the dynatube without knowing that there was liquid fuel within the tubing. 

The technicians managed to put the fire out with a parts rinse bucket nearby, which they had to refill 
several times with water in the safety shower. Apparently, there was not a charged water line in the 
vicinity. Once the fire had been reduced in size from a large flame to a small flame at the open end of the 
dynatube, a technician cupped the end of the dynatube with his SCAPE suit glove and placed the 
aspirator in the flame, which immediately put out the fire. 

The engineers on console in the LCC believed that they had purged the manifolds enough to reduce the 
residual MMH to manageable levels. Immediately preceding the feedline dynatube disconnect, the 
engineer on console incorrectly read the fuel feedline pressure transducer on the vehicle. The subject 
transducer indicated 16 psia (approximately atmospheric pressure). In actuality, the transducer was 
biased low (as determined from a previous test completed during the OMDP of RP01 about 18 months 
prior); therefore, the actual pressure in the manifold had increased to about eight psi above atmospheric 
pressure. There had also been a shift change between the venting and disconnection operations which 
may have led to the transducer bias going unnoticed. The increase in pressure may have been a result 
of a leaking manifold one isolation valve (LV317, the valve holding back the bulk propellant from the 
feedline). 

Another possible scenario (not included in the formal mishap report) for the pressure increase was put 
forth stating the pulse purges were unable to remove all the liquid MMH as a result of a low point trap 
present in the manifold near the MD317 (manifold 1 drain/purge QD) AHC interface. Figure 33-3 shows 
the basic layout and low point in fuel manifold 1 in the right pod stinger area. It is believed that during the 
purge, gas was unable to enter the line through the MD317 QD to displace the liquid MMH out of the 
manifold. This was a result of a small bubble that had formed in the low point as a result of helium 
coming out of the liquid MMH/helium solution. The helium slowly coming out of solution may have been 
the source of the pressure rise in the manifold rather than a leaking manifold isolation valve. Once the 
fire started, it heated the area thus increasing the pressure and pushing additional fuel out of the fuel 
feedline that was trapped. In both scenarios (leaking manifold isolation valve or helium coming out of 
solution), liquid MMH was present in the manifold line just prior to and during the fire and the manifold 
pressure increase went unnoticed. 



Figure 33-3: Approximate Manifold 1 Layout Schematic 


Page 49 



NASA/TP-2009-214769 


The “official” cause of the ignition from the mishap report was stated to be electrostatic discharge passed 
from the materials (Orcofilm being one of them) used for spill protection to the SCAPE suits, gloves, and 
tools. The spill protection materials and SCAPE suit failed electrostatic testing performed following the 
mishap. Another possible cause for ignition (not put forth by the mishap report) was a decomposition 
combustion reaction of the MMH and a material that it contacted. A hypergolic reaction with the N 2 0 4 
(N0 2 ) vapors that were possibly leaking from a nearby double-bagged oxidizer feedline dynatube was not 
a likely source of ignition since the aspirator was positioned directly adjacent to the open end of the 
oxidizer feedline. An atmosphere of approximately 10% N 2 0 4 (N0 2 ) vapors is needed for a hypergolic 
reaction with MMH vapors in air. With the amount of atmosphere that the aspirator was drawing in and 
the fact that the feedline was not receiving a constant pressurized source of N 2 0 4 , obtaining a 10% 
atmosphere of N 2 0 4 (N0 2 ) vapors was not possible. 

About six months to a year prior to the fires on left and right pods of OV-105, a Tiger Team (an 
independent investigation team) was investigating on-orbit thruster failures. One finding from the study 
was that evacuation of the thruster feedlines to remove residual propellant prior to a thruster removal and 
replacement was detrimental to the health of the thruster valves. Therefore, the thruster removal and 
replacement procedures were changed to disconnect the thruster feedlines utilizing a pulse purge rather 
than an evacuation, also known as a “hot” removal and replacement. Dozens of thrusters were 
successfully removed and replaced without incident following this change. The inadequacy of the pulse 
purges in removing all of the residual fuel in the feedline and the unnoticed pressure increase in the 
manifold from either a leaking manifold isolation valve or helium coming out of solution (operational 
human errors) were the root causes of this incident, but other unknown factors likely played a role. 

Following the fire, the oxidizer feedline was plugged and the fuel feedline fitting was tightened to safe the 
system. There were no reported injuries. There was an appreciable amount of damage to flight 
hardware from the fire and the water that was used to extinguish it, including several RCS thrusters, three 
purge ducts, some electrical harness ties, and eight thermal control system (TCS) blankets. This damage 
required removal of the OMS pod for refurbishment at the HMF. A total of 33 PRACA items were taken 
for damage as a result of the fire. The three purge ducts, eight thermal blankets, and four propellant line 
clamps were removed and replaced with like items along with thrusters R1R, R1U, R3A, R3R, R3D, and 
R1A (which was removed in the OPF immediately following the fire). The only thrusters that had fire 
damage were R1R, R1U, and R3A, the rest were required to be removed since they were located on the 
same manifold as another thruster that was being removed. The thrusters were refurbished and returned 
to logistics as usable spares. 

The delay as a result of the repair from the fire was an impact to the processing flow of the pod; therefore, 
two pods were swapped between orbiters. OV-102’s RP05 was re-assigned to OV-105 and RP01 went 
to OV-102, after repairs. RP05 had just come out of its OMDP. 

There was not one simple reason for this incident. As with most accidents, many different, seemingly 
unrelated items created the exact environment needed to support a fuel fire. The following items were 
noted as lessons learned from this incident: 

• Operational procedures did not adequately safe the system for hazardous operations (a root 
cause) 

• System hardware design forced complicated thruster removal and replacement operations 

o Tiger Team results led to an increase in hazard during the thruster removal and 
replacement operation 

• Designs should be completed with operability in mind 

o The thruster feedline dynatubes in the FRCS allow for independent disconnection of the 
MMH and N 2 0 4 lines, where the ARCS feedline dynatube bellows force the disconnection 
of the MMH and N 2 0 4 lines simultaneously (the orbiter FRCS and aft pods were designed 
and built by different companies) 

• Understand and design to mitigate external/environmental impacts 

• Understand failure modes during all phases of operations 
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• Two valve isolation is the desired configuration (if possible) during an operation involving 
hypergols being opened to the atmosphere 

• Training of the technicians that performed the operation was found to be inadequate (another root 
cause) 

• Fire fighting equipment should be nearby when an operation involving the opening of a hypergolic 
propellant line to atmosphere is being performed 

o Walkdowns prior to the operation failed to point out the lack of fire fighting equipment 
o It should be noted that SCAPE personnel are not required to stay and fight a fire; 
however, historically most stay in attempt to contain the situation 

References: Buzzard; Draus 


34 ORSU Open Manual Valve N 2 0 4 Spill (3/1/1996, WSTF 400-Area) 

On March 1, 1996 at the 400-Area Oxidizer Ready Storage Unit (ORSU) at WSTF, a large spill (about 90 
gallons) of N 2 0 4 occurred. This incident was the direct result of manual valve MV-40X-FIB77 being 
slightly open allowing a 1-2 gpm flow rate of liquid N 2 0 4 into the vent system of the 300 gallon oxidizer 
catch tank (proximate cause). It is believed that a propellant tank venting in TS 405 caused liquid N 2 0 4 to 
accumulate in the vent system. The liquid was subsequently pushed out through the vent and into the 
oxidizer burner stack. This venting was completed following a PRCS thruster acceptance test procedure 
(ATP) in the test stand. It is standard procedure to vent the primary thruster propellant tanks from 
approximately 260 psia to approximately 50 psia following an ATP. 

There was a crew located at the ORSU to collect a sample of the N 2 0 4 in the tank since it was being 
circulated on the same day to filter out particulate. Prior to this sample being taken, the primary oxidizer 
burner was set to 100 percent by the blockhouse monitor to support venting of N 2 0 4 (N0 2 ) vapors from 
the ullage of the storage tank to ambient pressure. The TS 405 propellant tank venting occurred shortly 
thereafter. The personnel in the vicinity were not exposed to the liquid N 2 0 4 or N0 2 vapors and were 
immediately evacuated to a safe area. It was later determined that a contributing factor was that the 400- 
Area vent system was not an active system; therefore, it did not receive the full engineering design review 
as did the pressurized (active) system (a root cause). It was also found that the 400-Area configuration 
was not properly managed (a root cause). 

Reference: “Investigation of the WSTF 400-Area Oxidizer Spill Incident” 


35 OPF2 GSE MMH Spill (2/17/1997, KSC OPF2) 

In OPF2 on February 17, 1997, liquid MMFI (approximately a pint) splashed onto three personnel while 
they were working on removing an overhead 1 -14-inch cap from the hypergolic vent line (the proximate 
cause) causing chemical burns to the arms of all three and the neck of one. They were all sent to the 
OHF. Five other individuals were sent to the OHF as a result of MMFI vapor inhalation. 

The technicians were performing a modification to the MMFI eductor system on the 10-foot left platform of 
OPF2. The modification included the installation of permanent hardware by removing flexhose interfaces 
and installing hard-line tubing, adding a suction port, and raising the eductor panel from the floor and 
attaching it to a railing. The last time the eductor system was used for an operation on the orbiter was 
about two years prior, in which MMFI was drained from the LRCS manifold two of Discovery for the later 
removal of thruster L2D. It was later determined that the vent line had only been “blown down” rather 
than educted with a vacuum; therefore, liquid was able to collect in the low points, which should have 
been designed out of the system (improper GSE design; a root cause). 

With the technicians in supplied air respirators and hypergol compatible aprons and gloves, the first part 
of the modification, which consisted of installing a new valve and tee assembly for the additional suction 
port, was completed without incident. No liquid MMH was noted as spilling even though the same 1 -14- 
inch vent line from which the spill occurs a couple weeks later, was opened. A reading of 0.8 ppm was 
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noted at one of the capped fittings on the tubing, but this was not out of the ordinary. The 1-!4-inch vent 
line was then opened a second time to install the modified 1-!4-inch line that connected the new valve to 
the vent line. Minor vapors were detected when the 1-%-inch vent line cap was removed. The 
technicians found that the modified line was too short and some other lines were installed incorrectly, so 
they re-installed the 1-%-inch vent line cap and reported the problems. 

When they returned to fix the installation a few days later, a few droplets of MMH dripped onto one 
technician’s glove and arm when he initially loosened the cap. He quickly rinsed off his arm in the nearby 
safety shower. The safety technician then proceeded to take interscan readings of the fitting, which he 
reported were 0.0 ppm. Since the readings were found to be 0.0 ppm, the technicians determined that 
the liquid was probably alcohol (used for cleaning the fittings), water, or condensate. They all then 
decided that it was safe to continue. Following this, the technician began to remove the overhead 1 -Vi- 
inch vent line cap when liquid MMH spilled out onto his and the other technician’s skin and the 
surrounding GSE. Another safety technician nearby notified the pad leader at the OPF operations desk 
to evacuate the OPF and activate the hypergol fans to remove the residual fuel vapors. The area warning 
“warbler” was activated and proved to be ineffective at getting all of the personnel out of OPF1, OPF2, 
and the OPF annex; therefore, the fire alarm was activated. This deactivated the hypergol exhaust fans. 
Why the area warning “warbler” was ineffective is unknown. 

The exposed technicians proceeded to take turns rinsing off in the safety shower while fully clothed and in 
their supplied air respirators. They then began their evacuation of the facility; however, their supplied air 
hoses became entangled forcing them to remove their masks while still in the MMH vapor cloud. Once 
they had exited the facility, paramedics on site began to examine them inside an ambulance. One 
paramedic indicated that the technicians had a fuel odor; therefore, they were instructed to remove their 
clothes so they could be rinsed off by fire personnel. They were then given blankets and transported to 
the OHF in two separate ambulances. One technician was told by paramedics to report to the OHF using 
his own personal vehicle. When he arrived at the OHF his clothes were found to be contaminated with 
fuel. He was told to shower and then put his contaminated pants back on once they were found to be 0.0 
ppm. About 30 minutes later, he removed the contaminated pants again as a result of a fuel odor, and he 
along with the other technicians were given coveralls. When fuel exposed clothing is rinsed with water, 
the water can conceal the residual fuel in the clothing until the water evaporates. This is likely why the 
residual fuel went unnoticed in the technician’s pants resulting in him being asked to put his clothes back 
on after showering at the OHF. Per safety guidelines, the clothing should have been treated as 
hazardous waste. 

The reason for the spill was an unknown low point in the l-V^-inch vent line which trapped liquid MMH. 
The reconfiguring of the lines allowed the low point to move around within the line and go unnoticed. It 
appears that the technicians reacted as best they could with the tools they had with the exception of not 
removing their clothing in the safety shower. The interscan fuel detector used during the operation was 
found to have a faulty pump. The pump was contaminated with liquid MMH and only worked 
intermittently; although, the interscan did read full scale high during the spill along with its alarm sounding. 
This could be the reason for the 0.0 ppm reading when the technician initially opened the cap; however, 
the pump could have been contaminated during the spill. There were several lessons learned following 
this incident including: 

• The fire alarms deactivated the hypergol fans and should not be used during a hypergol related 
evacuation 

o Following the incident a by-pass switch was added to the heating, ventilation, and air 
conditioning system outside each OPF so the hypergol fans can be turned on when a fire 
alarm has been activated 

o A fire alarm should not be used to evacuate personnel following a propellant spill 
o All processing facility personnel should be familiar with evacuation alarms 

• The recommended decontamination procedure was not followed in which the person’s clothing is 
to be removed prior to entering the safety shower and the clothes are to be treated as hazardous 
waste 
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o Following this incident “modesty garments” were placed in boxes near the safety showers 
throughout KSC 

o Curtains were also added to the safety showers 

• After being involved in a serious incident, personnel should immediately seek medical attention 
and should not be asked to drive themselves to the medical facility 

• The medical personnel did not seem to be knowledgeable as to the proper treatment of a person 
who has been exposed to hypergols 

• An improper GSE design can destine a system for failure 

o Low points in GSE should be designed out (root cause) 

Reference: Stefanovic 


36 HMF Sample Valve MMH Spill (3/26/1997, KSC HMF M7-1212 West Test Cell) 

On March 26, 1997, in the HMF M7-1212 West Test Cell, an MMH spill occurred from a GSE sample 
valve. FRC4 had been removed from OV-104 as a result of a suspect thruster dynatube seal saver 
installation. The dynatube disconnection operation required the thruster manifold to be drained and 
educted for no less than eight hours. Following this, preparations were made to perform a sampling 
operation. Three technicians set up the 20-foot safety clear area. One technician remained outside the 
clear and was not wearing any PPE. The other two donned hypergol compatible aprons and gloves and 
wore supplied air respirators. 

One technician powered up the aspirator and then began to remove the sampling valve outlet cap from 
the MD137 flexhose (see Figure 36-1 for a close-up view of the sampling valve). A TVC of the area was 
then performed with a resulting reading of 0.0 ppm. The technician laid the aspirator hose on the side of 
the rack, which was not a suitable position to capture any liquid or vapor that may be released from the 
valve outlet as the procedure stated. 



Figure 36-1: MD137 Flexhose Sample Valve 
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The technicians were then at the point in the procedure where the valve was to be opened. The 
procedure was written to imply that there may be some vapor released from the valve when it was 
opened. Liquid MMH was not expected, but, as it turns out, there was a liquid release once the valve was 
opened. MMH splashed out of the sample valve and onto one technician’s left arm, the glove of the other 
technician, and the surrounding area. It is estimated that approximately %-cup of liquid MMH spilled from 
the valve. The technician immediately closed the valve and began to evacuate the test cell along with the 
other technicians. He exited the test cell and located a safety shower, which he began to use. A medical 
and fire team were immediately dispatched to the scene and the engineers on console notified the proper 
authorities. The technician did receive chemical burns on his arm for which he was treated at the OHF. 
He was released within a few hours. 

The source of the liquid MMH was a low point in the flexhose, which retained some of the liquid MMH 
following the eductions (proximate cause). How the liquid MMH was able to enter and collect in the 
flexhose low point is more complicated. The post-incident data analysis showed that the manifold drain 
and eduction were quite typical with no out-of-the-ordinary anomalies. However, this was the first time (at 
least in the memories of the engineers working the procedure) that a manifold had been drained in which 
the MMH was not saturated with helium. Previously, during a separate operation, the manifold had been 
drained and later backfilled with liquid propellant that was not saturated with helium. Helium had not been 
introduced into the system since the module had not flown following that operation. 

When helium saturated MMH is vented to ambient and drained from a manifold, the helium that was 
absorbed into the fuel comes out of solution and forms bubbles which rise to the high point of the system. 
The bubbles expand and act as an expulsive force while the system pressure is decreasing. This helps 
to “push” the liquid MMH out of the manifold. When unsaturated MMH is drained, a capillary action takes 
place (this is similar to holding a finger on the end of a liquid-filled straw). The MMH does not drain from 
the manifold as easily and, over time, it collects at the low points as a result of in-specification leakage of 
the upstream manifold isolation valves. With the system pressure at approximately 23 psia, the trapped 
liquid fuel in the low point of the flexhose was forced out to atmosphere when the sample valve was 
opened. Operational human error was one root cause since the engineers were unaware of the effects 
that the lack of helium saturation in the manifold would cause during the drain. The following are findings 
and observations from the incident report: 

• The flexhose had a low point in it; this should be eliminated though proper flexhose routing 

o The manifold had an inadequate drain and eduction to remove all of the liquid MMH 
o Operational human error (a root cause) 

• The test team did not completely understand the ramifications of draining a system which 
contained unsaturated MMH 

• The aspirator was not positioned properly at the valve when it was opened, as the procedure 
stated 

• The procedure did not identify the potential for liquid MMH being released from the sample valve 

o There was no method to verify that the manifold did not contain any liquid 

Reference: Sullivan 


37 VAFB Titan IV A K-18 N 2 0 4 Spill (7/16/1997, VAFB SLC-4E) 

On July 16, 1997 engineers at VAFB SLC-4E were remotely pressurizing the two N 2 0 4 propellant tanks, 
one each on the two Titan IV A’s SRM TVC systems. Reference Figure 31-2 for a diagram of the TVC 
system. The propellant tank servicing was completed without incident about nine days prior to the 
pressurization. Each tank contained about 8,400 lbs (702 gallons) of liquid N 2 0 4 . The rocket was being 
prepared for a planned mid-July 1997 launch on a Department of Defense mission to replace an aging 
reconnaissance satellite. Figure 37-1 shows a Titan IV A configuration at its launch pad and points out 
the location of the N 2 Q 4 tank. 
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Figure 37-1 : Titan IV A on Launch Pad 

About 20 minutes after initiating the propellant tank pressurization, liquid N 2 0 4 was observed to be 
streaming out of the aft skirt heat shield region on both SRMs. There were no reported injuries and the 
flight hardware had minimal collateral damage (mainly on the SRM nozzles). At the time of the observed 
N 2 0 4 release (likely initially noticed by the signature brownish-orange N0 2 vapors characteristic of an 
N 2 0 4 spill) the propellant tanks were at a pressure of about 830 psi. The target pressure was about 1 ,040 
psi. The engineers quickly began to depressurize the propellant tanks, which had the immediate affect of 
decreasing the rate of propellant release. The tanks were vented from their initial pressure of about 830 
psi to a final pressure of 38 psi, at which time the N 2 0 4 release ceased. At that time, all systems were 
secured and the operation terminated. It was decided to offload all of the propellant from the subject 
tanks, so about eight hours later, the engineers and technicians began the offloading procedure. This 
operation was completed without incident. Following the offload and evacuation of the TVC N 2 0 4 system 
and tubing, the total amount of propellant transferred was estimated. About 1,160 gallons of N 2 0 4 was 
re-captured as a result of the drain-back. This logically implies that about 244 gallons of N 2 0 4 was 
released to the atmosphere. 

The source of the leak was found to be the electronic compartment purge ports on two flow control valves 
(FCVs) on SRM #1 and one FCV on SRM #2. A cutaway view of the FCV is shown in Figure 37-2. 
These valves (along with the one remaining valve that did not leak) were removed and sent to the 
manufacturer for failure analysis. Upon disassembly of the three failed valves, evidence of combustion 
was noted at the electrical compartment’s omniseal. The omniseal had been extruded through the 
sealing surface and the retainer ring had been ejected. The degradation of the omniseal resulted in liquid 
N 2 0 4 flowing into the FCV’s electronics compartment and out the purge port. There were no leaks found 
within the TVC propellant tank or the associated system plumbing. 
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Seal Vent and GN 2 Purge 



Packing Retainer/Omni Seal 
Figure 37-2: Titan IV A TVC FCV Cutaway View 


Failure analysis determined that the proximate cause of the seal degradation was traced to a chemically 
reactive incompatibility of N 2 0 4 with the cleaning agent, Bio T-200A, used on the FCVs during 
manufacturing at that time. Freon had long been the industry standard for oxidizer component cleaning; 
however, in 1987 the international scientific community endorsed the Montreal Protocol Treaty which 
phased out the use of halogenated hydrocarbons (including Freon) due to their proven role in ozone 
depletion. In early 1994, the Titan IV program adopted a policy to phase-out the use of Freon for cleaning 
of components and simultaneously phase-in the use of a trade product, Bio T-200A. 

The Titan IV program had recently finished qualification testing and production of a new component in the 
Titan IV A’s SRM TVC system just prior to the buildup of the K-18 launch vehicle. The new component 
was the FCV (four places total in the system). K-18 was the first mission with the new FCVs. Prior to K- 
18, the valves were an electromechanical valve (EMV), which had been used on the Titan IV and Titan III 
program since the early 1970s. 

The component design change was driven by the difficulty in manufacturing the EMVs, as well as some of 
its internal components becoming obsolete. A cutaway view of the EMV is shown in Figure 37-3. The 
intent of the valve redesign was to make as few changes as possible to allow for consistent 
manufacturing, part machining, and part procurement, as well as using the same outer housing of the 
valve to allow the new FCV to essentially be “dropped in” without any TVC system modifications. There 
are several noted differences between the two valve designs. One significant difference is their method 
of fastening the packing retainer to the omniseals. Both designs utilize an omniseal to isolate the N 2 0 4 
from the valve’s electronic compartment. Flowever, the original EMV design fastened the omniseal and 
packing retainer using four screws, whereas the superseding FCV design employed a snap-ring to fasten 
the retainer. The four mechanical screws on the EMVs left a much smaller gap (if any) between the 
component surfaces, whereas the FCVs snap ring design, while sufficient for its launch duty, had a large 
enough gap between the component surfaces that the liquid Bio T-200A cleaning solvent was able to 
accumulate on the omniseal spring. 
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Figure 37-3: Titan IV A TVC EMV Cutaway View 


A total of 74 EMVs which had been cleaned with Bio T-200A successfully flew in the Titan IV A TVC 
system. The Titan IV program accepted the use of Bio T-200A as the cleaning agent for the new FCVs 
by analysis, ground test, and similarity to the cleaning agent’s use on the EMVs. The failure of three of 
the four FCVs on this one rocket, compared to the success of 74 EMVs on successfully launched rockets, 
suggests that the method of qualifying the FCVs was flawed. 

In June of 1994, a subcontractor was commissioned by the FCV manufacturer to test the compatibility of 
liquid Bio T-200A with N 2 0 4 . Tests showed that N 2 0 4 reacted violently with Bio T-200A after about five 
hours of exposure (at ambient pressure and temperature). As a result of this finding, precautions were 
added in the EMV (and later the FCV) manufacturing process that included a drying out the components 
via a baking process since it was known that a dry film of Bio T-200A is compatible with N 2 0 4 . The 
manufacturer used a 30-minute bake at 100 °F, believing that these conditions were sufficient to remove 
all the liquid Bio T-200A. Flowever, Bio T-200A has a relatively low vapor pressure and thus requires a 
comparatively long time for complete evaporation. Following the K-18 N 2 0 4 spill, an investigation 
identified that the FCV manufacturing process indeed left a wet residue of Bio T-200A under the packing 
retainer (shown in Figure 37-2). 

The presumed sequence of events leading to the subject component failure was as follows: 

1 . By the completion of the TVC N 2 0 4 propellant tank loading, the cavity adjacent to the packing 
retainer filled with liquid N 2 0 4 

2. The liquid N 2 0 4 vaporized and migrated into the packing retainer crevice 

3. During the tanks’ pressurization, the trapped N 2 0 4 vapor re-condensed into a liquid and reacted 
with the residual Bio T-200A in the packing retainer crevice (see Figure 37-4) 

o The energy of this reaction damaged the packing seal 

o The force of the increased system pressure overcame the remaining, compromised 
integrity of the seal components and thus flowed past the seals to atmosphere. 
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Figure 37-4: Titan IV A FCV Failure Description 

The root cause of this incident was process creep. This was categorized as “Improper GSE/Vehicle 
Design” in Appendix C: Detailed Assessment of Incidents. The USAF noted that the process of 

accepting the Bio T-200A as a cleaning solvent was not well documented and appears to have been 
poorly managed. The chemical compatibility tests (dry film and wet residue) were not given the proper 
attention by the manufacturer who believed that a dry film was the only possible remnant of the Bio T- 
200A solvent as a result of their baking procedure. 

Following the incident, use of Bio T-200A as a cleaning solvent on components in the Titan IV program 
was prohibited. All remaining uninstalled FCVs were disassembled, cleaned thoroughly with methyl ethyl 
ketone (MEK), cleaned thoroughly with Freon, reassembled, retested, and then returned to logistics. The 
reconnaissance satellite was launched successfully on October 23, 1997 on the Titan IV A following the 
replacement and retest of the four FCVs. 

References: Kehler; Hill; Schindzielorz; What You Should Know... 


38 Pad 39B Slope N 2 0 4 Spill (11/6/1997, KSC Pad 39B Slope) 

Following the oxidizer (N 2 0 4 ) loading of Columbia for STS-87 at approximately 9:30 PM on November 6, 
1997, a flange gasket (seal) failed in the Pad 39B GSE “cross country” line cross-over valve complex (the 
GSE lines that connect the N 2 0 4 farm to the launch pad tower and vehicle). The seal failure resulted in 
the spilling of about 25 to 50 gallons of liquid N 2 0 4 onto Pad 39B’s concrete base (proximate cause). The 
liquid N 2 0 4 ran down the slope and contacted some live electrical cables and a small electrical fire 
followed. The wind direction at the time of the spill was such that the oxidizer cloud drifted away from the 
launch pad tower and the vehicle. 

During the N 2 0 4 GSE drain down following OV-102’s oxidizer servicing, the cross-over valves were 
closed. A water hammer effect from the liquid column in the GSE lines opened a gap at the cross-over 
valve flanges (inlet and outlet). This gap enabled liquid oxidizer to leak out onto the launch pad slope (the 
concrete incline from ground level to the base of the launch tower). 

The SCAPE van driver was the first to detect the spill when he smelled oxidizer in the area of the fuel 
farm (see Figure 38-1 for a geographic layout of Pad 39B). Safety officials at the launch pad perimeter 
noted the source of the oxidizer vapors was the Pad 39B west slope. Three technicians in SCAPE were 
directed to proceed to the general area of the vapor source from their location on launch pad tower 107- 
foot level. Upon arrival, the technicians noted that heavy N 2 0 4 (N0 2 ) vapors were leaking from both the 
inlet and outlet flanges of the return cross-over valve. They also noted that there were still several 
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gallons of liquid N 2 0 4 on the ground near the flanges and at the bottom of the slope in a grassy area. 
Sparks were seen shortly after the arrival of the technicians; therefore, two of the three evacuated. Some 
of the liquid N 2 0 4 that had flowed down the slope incline contacted the electrical conduits routed along 
the ground that supplied power to nearby lighting. The technicians were unaware that the N 2 0 4 had 
dissolved some of the cabling insulation. 



Vehicle Location 
(Not Shown) 


Spill Location 


~Wind Direction 


Oxidizer Farm 


Fuel Farm 


Cross Country Lines 


Figure 38-1: Geographic Layout of Launch Pad 39B 


Since it was late at night, the technicians could not see the entire spill area very well. This was a result of 
the area being poorly lit during nighttime operations. Therefore, the technicians decided to activate some 
additional lighting at the cross-over valve complex. When power was issued to the lights there were 
several sparks and a small electrical fire ensued. The lights were quickly turned off and the small fire was 
put out with water. During the clean-up effort, one technician inhaled N 2 0 4 (N0 2 ) vapors as a result of his 
SCAPE suit zipper not being secured. He was sent to the OHF and released later that night. 

There was a concern that the oxidizer vapor cloud had contacted and possibly damaged the Space 
Shuttle stack and GSE on Pad 39B. At the time of the spill, the wind direction was away from the vehicle 
and launch pad in approximately a southwestern direction (034 to 053 degrees) at a speed of five to ten 
knots; however, detailed inspections were still completed. Thermal Protection System (TPS) engineering 
performed a vehicle inspection and litmus-pH test to determine if the vehicle TPS was exposed to oxidizer 
vapor. They verified no damage or contamination to vehicle TPS. All other engineering groups (vehicle 
and GSE) performed inspections and found no damage with the exception of the electrical cables on the 
Pad 39B slope. 
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About two months prior to the spill, an operation was completed on the cross-over valve complex in which 
the flange gaskets had to be replaced. This operation was a result of noted leaks at the cross-over valve 
complex return valve as a result of (it was assumed) an alignment problem with the valve flanges. The 
valve mounts were removed to correct the misalignment issue. The mount removal was completed 
without authorizing the out of configuration condition as it was against what was required per the cross- 
over valve drawings. 

During the repair procedure, the flange gaskets were replaced; however, there was a discrepancy in the 
Pad 39B drawing for the flange. An engineering order had been issued in 1978 to the Pad 39A drawings 
to require the installation of American National Standards Institute (ANSI) sized gaskets. The Pad 39B 
drawings were never corrected; therefore, an undersized gasket was installed. It was also found through 
a detailed analysis of the flange gasket installation procedures that the flanges were not leak tested with 
GN 2 following the 24-hour retorque of the flange bolts. This could have led to a change in the gasket 
clamping force. The combination of the undersized gasket and an inherent preload from an inadequate 
support structure under the valve complex (improper configuration management) were the root causes of 
this incident. The problem report closure statement for the spill stated the following: 

“The flange gaskets which leaked were of the white gar lock material and cut to the dimensions 
specified per [the Pad 39A cross-country line] drawing. An investigation revealed the material of 
the gaskets was compatible and acceptable for oxidizer use. The apparent problem was with the 
dimensions specified for 150 lb flange gaskets. The internal diameter was too large, reducing the 
sealing surface, and a slight gasket failure led to the leak. A walkdown of the pad B [hypergol 
tubing] was performed and all white 150 lb gaskets were identified and replaced with gaskets cut 
using the new dimensions released per the [Pad 39B cross-country line] drawing. . .All subsequent 
[helium] leak checks and propellant flows showed no signs of further oxidizer leakage. ” 

Following this incident, the Pad 39B drawings were updated to require the installation of the proper flange 
seals. All the cross-over valves were removed and replaced with flanged pipe as they were no longer 
needed for hypergolic propellant loading. This reduced processing time on the valves and greatly 
reduced the risk of a leak at the valve flanges. Figure 38-2 is a photograph of the location where the 
cross-over valve complex was previously located at Pad 39B and Figure 38-3 is a photograph of the 
location of the Pad 39B fuel cross-over valve complex with the fuel farm and Vehicle Assembly Building in 
the background. 
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Figure 38-2: Former Site of Oxidizer Cross-Over Valve Complex at Pad 39B 
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Figure 38-3: Former Site of Fuel Cross-Over Valve Complex at Pad 39A 

References: KSC SSP PRACA Database (PR S70-0700-06-002-0019); Henson 


39 STS-109 OV-102 APU Hydrazine Spill (8/20/1999, KSC OPF3) 

During APU deservicing for OMDP in OPF3, approximately 4.5 tbsp of hydrazine (N 2 H 4 ) spilled from a 
GSE flexhose that was previously connected to a high point bleed Leer-Romec AHC. The liquid dripped 
onto the orbiter’s left hand wing inboard elevon trailing edge and the 11 -foot level of OPF3. This AHC 
was only accessible in the orbiter aft; therefore, a flexhose had to be routed to it through an access door 
for testing. It was believed that the spill was a result of residual N 2 H 4 leaking from the removed high point 
bleed flexhose that had been placed on the platform without a drip pan beneath it. There were no leaks 
noted during the operation prior to removal of the flexhose. The technician left the flexhose uncapped 
(the proximate cause) following disconnection and the hydrazine ran along the platform grating and then 
dripped onto the orbiter. Two tiles were removed and inspected along with the underlying structure. No 
damage was found on the orbiter elevon structure. 

The vapor levels were checked in all of the applicable areas and all were acceptable for ferry flight 
closeouts (OV-102 was leaving for Palmdale, California soon after the spill). The root causes of the 
hydrazine spill were an insufficient GSE design in OPF3 and lack of experience by the technician that left 
the flexhose uncapped (improper training). This spill was the driver for implementation of new permanent 
GSE in each Space Shuttle OPF. The new panels were installed, calibrated, and validated in each OPF. 
They provide versatility as well as the additional safety of a permanent installation. The installation of 
these new panels substantially reduced the possibility of another APU N 2 H 4 fuel spill during this 
procedure. 

References: Gehman (CAIB Volume I finding F4.2-7 and Volume II pg 427); 1999-232-00007 
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40 WSTF Pathfinder Axial Engine Valve Failure (8/7/2000, WSTF TS 401) 

On August 7, 2000, during the oxidizer system decontamination procedure following an engine hotfire test 
that occurred on August 3, 2000, an axial engine valve and N 2 0 4 tubing failed (exploded) causing 
extensive damage to the surrounding hardware. There were no reported injuries. The volume of the spill 
was approximately one to two gallons mixed with several gallons of water. 

Following the completion of the hotfire test near the end of the work day, the test team and customer 
agreed to delay the subsequent propellant sampling and decontamination until the next day (Friday). The 
following day it was discovered that only one person was available for sampling and the rest were out on 
vacation. The sampling was completed late in the day, which did not allow enough time for the 
decontamination procedure to take place until the following Monday. 

On Monday August 7, 2000, the hardware was configured to support the decontamination procedure in 
which water was flushed though the propellant lines (both MMH and N 2 0 4 ). It is usually not good practice 
to flush an N 2 0 4 system with water as it forms nitric and nitrous acids. The procedure was performed 
using a TPS (Test Preparation Sheet used primarily for non-routine work) rather than a WJI (WSTF Job 
Instruction used primarily for repetitive, routine work). The test conductor (TC) proceeded to perform a 
vent of the oxidizer manifold even though this work step was not in the procedure or even necessary 
since the decontamination was intended to be completed with the manifold pressurized. A large N0 2 
cloud was then noted at the test cell drain valve. The TC decided to not vent to MMH manifold since it 
would possibly mix residual propellants; therefore, he proceeded to cycle the engine valves. Following 
this, another “large oxidizer [N0 2 ] cloud was observed and a large combustion event occurred,” as quoted 
from the WSTF report. It is assumed that the damage from this event was unnoticeable since the TC 
continued on after briefly stopping the test. 

Regardless of the previous off-nominal events, the test team decided to proceed with the water 
decontamination. There was also supposed to be a nitrogen purge of the system, but the test team 
decided to not perform this operation. Deionized water at approximately 170 psig was introduced into the 
fuel lines. Shortly thereafter, the technician connected the water from the same source into the N 2 0 4 
propellant lines. The technician then proceeded to exit the test cell and as he did, there was another 
explosion. A loud bang was heard by the technician and water was observed flowing out of an unknown 
source from the test article. The test system was then vented remotely. The following items had either 
failed or were damaged: 

• Failure of a cast aluminum body of the axial engine valve 

• Failure and fragmentation of several 1-inch diameter 321 stainless steel hardlines 

• Damage to 12-inch long, 1-inch diameter thrust ring mounting bracket 

• Damage to the engine valve thrust ring mounting bracket 

• Damage to support structure which was impacted by a 321 stainless steel hardline 

The proximate cause for the failure was inconclusive. The most likely scenario is that MMH and N 2 0 4 
reacted on the oxidizer side of the engine valve (a bi-propellant valve) possibly through a Kalrez seal 
failure. The engine valve has redundant seals on both the oxidizer and fuel sides. In between the seals 
there is a small cavity with a check valve that is designed to vent propellant seepage between the seals. 
The reaction either propagated a shock wave into the water filled system or accelerated columns of liquid 
in the water and vapor filled oxidizer system. Another possible proximate cause for the failure is the 
removal of the vacuum conditions before the completion of the decontamination process. 

Working steps out of sequence, not performing steps, and completing the decontamination procedure 
several days later than required (operational human error) along with performing the procedure with a 
TPS rather than a WJI were the root causes of this incident. Proper care was not taken with respect to 
procedure adherence and development. 

Reference: “Investigation Report of the WSTF Peacekeeper Axial Engine Valve Damage” 
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41 WSTF Pathfinder Small MMH Fire (8/12/2000, WSTF TS 401) 

On August 12, 2000, a procedure was underway (using a TPS) to disconnect a fuel feedline to 
decontaminate the Peacekeeper Pathfinder Test Article MMH system. There were two technicians in the 
test cell. During the disconnection several MMH drips accumulated on some nearby hardware (proximate 
cause of the spill). The technician began to feel a significant amount of heat on the glove of his ILC suit 
(similar to a SCAPE suit) and yelled “fire.” A safety observer in street clothes located at the door of the 
test cell then entered and began to spray the two technicians with water. The second technician then 
grabbed the hose and began to spray down the area where the fire started, extinguishing it. There was 
minimal damage to the hardware and there were no injuries. The decision was made to complete 
disconnection of the feedline following the fire; however, the provided flange would not fit the feedline, so 
the operation was secured. 

The proximate cause of the fuel ignition is unknown. Earlier, during the oxidizer system decontamination 
(see Section 40), an unexplained rupture of an oxidizer feedline had occurred on the test article. It is 
thought that residual oxidizer could have caused the MMH ignition, but it is uncertain. Other possibilities 
include rust from the test stand or static electricity as proximate causes. The root cause of this incident 
was operational human error as a result of the lack of oversight and careful planning following the incident 
on the same test article a few days earlier. 

The quick reaction (albeit unsafe since he was not wearing the proper personal protective equipment) of 
the safety observer, likely minimized the hardware damage and prevented injury. According to WSTF 
Standard Instruction (WSI) PROP-0049, “The Buddy System in the Propulsion Department,” the third 
technician should have been attired in ILC. 

Reference: Gorham 


42 WSTF Pressure Transducer Explosion (3/25/2003, WSTF TC 831) 

On March 25, 2003, in Test Cell 831 at WSTF, during the life cycle testing of an N 2 0 4 Improved Pilot 
Operating Valve (IPOV), there was an explosion. Following the explosion, there was an N 2 0 4 vapor 
release (approximately three quarts) into the test cell. There were no reported injuries since the cell was 
vacated prior to starting the test. It was found that a pressure transducer had catastrophically failed as a 
result of a material incompatibility within the pressure transducer (proximate cause). Figure 42-1 is a 
photograph of the test setup following the explosion with the relative location of the pressure transducer 
prior to the explosion. 

The IPOV was in the process of being validated following some modifications that were made to the 
valve. The operating pressure at the valve inlet was approximately 276 psia. The test was simply flowing 
liquid N 2 0 4 from one tank into another by cycling the valve. The pressure transducer was in the system 
to monitor this inlet pressure. Approximately 36,000 (of the planned 80,000) cycles of the valve, with a 
flow duration of approximately 80 ms and a maximum flowrate of 1.91 Ib/sec, had been completed when 
the explosion occurred. The proper emergency procedures were immediately implemented following the 
incident. These procedures included securing the test cell and deactivating the air handler for both the 
test cell and the attached building. There was no reported fire following the explosion. 

Initial inspections of the pressure transducer indicated that the transducer failed as a result of one of the 
following: over-pressurization, inadequate design, or cyclic fatigue at a highly stressed location. Since the 
pressure transducer failed, data from it at around the time of the failure may be suspect; therefore, the 
investigation included a detailed inspection of the nearby system tubing to determine if there was an over- 
pressurization event. Close inspection of the pressure transducer itself would indicate if the transducer 
failed from cyclic fatigue or was subject to a ductile failure from a single overload event. 
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Figure 42-1 : IPOV Test Setup 


It was found that the pressure transducer failed at welded connection between the port (media) housing 
and the sensor housing. Figure 42-2 is a photograph of the pressure transducer following the explosion. 
It was calculated that the approximate pressure to fail this butt weld connecting the two 300 series 
stainless steel components was approximately 12,700 psi. It was also found that the system tubing 
showed no sign of yielding due to an increased pressure; therefore, the system pressure did not exceed 
the calculated tubing yield value of 3,400 psi. The pressure transducer diaphragm was found to have 
failed at an approximate calculated pressure of 4,000 psi. The pressure then built up very quickly in the 
small volume around the diaphragm and was unable to properly relieve through the 0.157-inch diameter 
port at the top of the transducer. This allowed the pressure in this small volume to roughly reach the 
12,700 psi transducer burst pressure. 

The component failure (over-pressurization) was a result of a fatigue fracture (crack) of the pressure 
transducer diaphragm (0.002 inches thick). This allowed silicone oil to leak into the small volume 
surrounding the diaphragm. Approximately 0.8 mL of silicone oil was used to fill the volume between the 
diaphragm and the silicon sensor. The liquid N 2 0 4 reacted with the silicone oil to form nitrated phenols, 
including dinitrophenol and trinitrophenol (picric acid), which are shock-sensitive compounds. Some of 
the nitrated phenols remained between the diaphragm and the sensor, while the rest were diluted into the 
liquid N 2 0 4 in the test system. When the IPOV was subsequently cycled, it is assumed that the shock 
wave in the liquid detonated the shock sensitive compounds in between the diaphragm and the sensor. 
N 2 0 4 (N0 2 ) vapors were then released from the openings in the system. The vapor cloud filled the test 
cell and was carried by the wind through an air handler of a nearby building. 

The presence of the silicone oil was not mentioned in the pressure transducer specification from the 
manufacturer. This is the case for many pressure transducers of this specific design. Close scrutiny of 
specifications during hypergol component procurement is extremely important. This incident was difficult 
to prevent since the WSTF personnel did not know that there was silicone oil in the pressure transducer, 
but an improper GSE design (component procurement) is designated as the root cause. The wind 
corridor was also assessed and, as a result of this incident, it was altered to reduce the risk to the 
surrounding buildings from an oxidizer vapor release. 
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Figure 42-2: Failed Pressure Transducer 


Reference: Anderson 


43 Titan IV N 2 0 4 Pump Explosion (8/12/2003, CCAFS LC-40) 

On August 12, 2003, at CCAFS launch Pad LC-40 (shown in Figure 43-1) during the bleed-in operation 
for the B36 Stage II (Titan IV) propellant load, the oxidizer centrifugal pump exploded (proximate cause of 
the N 2 0 4 spill). The Titan IV launch vehicle was being loaded in preparation for the September 9, 2003 
launch of the National Reconnaissance Office’s payload. Along with the liquid N 2 0 4 release of 
approximately 40 gallons, the explosion created a large amount of shrapnel which caused significant 
damage to the surrounding GSE. The pump was completely destroyed as shown in Figure 43-2. 
Fourteen people reported to an on site health facility. They were all later released without injury. The 
storage tank holding several thousand gallons of liquid N 2 0 4 remained intact with minimal damage. An 
extensive investigation was initiated as a result of the Space Shuttle Program using these same pumps at 
Pads 39A and 39B (eight pumps in four locations) along with the Titan program which used them at LC- 
40. 

The engineers had noticed a decrease in the oxidizer pump flow rate (34-50 gpm versus 200 gpm) during 
the 18,600 gallon loading of the Stage I N 2 0 4 tanks. A meeting was held to discuss this reduction in flow 
rate in which the contractor and government team chose to continue on with the Stage II load. The 
consensus of the meeting was that an internal filter had become partially clogged at the oxidizer farm. 
The personnel had seen this sort of occurrence previously. Operational human error is considered a root 
cause as a result of the loading team not investigating the decreased flow rate issue further. 

Following the pump explosion, the loading team quickly removed power from the pump, closed the flow 
control valves at the oxidizer farm, and immediately evacuated the pad. The large N0 2 cloud that was 
created following the explosion was found to pose no danger to the local communities; however, a 5,000- 
or 12,000-foot clear (depending on the wind speed and direction) was put in place around the oxidizer 
farm. 


Page 65 


NASA/TP-2009-2 14769 



Figure 43-1 : LC-40 at CCAFS 



Figure 43-2: Pump and Motor After Explosion 


The incident failure analysis concluded, according to Crass, that there was a “cooling anomaly at the 
[carbon graphite journal] bearings... leading to [an explosion] in the stator can winding area.” It was found 
that the most likely contributor to this was a clogged filter in the pump recirculation loop that circulates 
liquid through the rotor cavity to cool the front and rear bearings as illustrated in Figure 43-3. Data 
analysis showed that the upstream and downstream temperature transducers indicated an increase in 
temperature of 8 °F across the pump. The low flow rate of 40 gpm and high ambient temperatures (high 
of 86 °F for 8/12/2003) accelerated the failure of the pump. At these flow conditions, the pump was not 
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able to be properly lubricated as a result of the high vapor pressure of liquid N 2 0 4 (these particular pumps 
are designed to be lubricated with the liquid that they are pumping). The excessive bearing wear led to 
damage to the stator liner can, allowing oxidizer to leak onto the hot copper windings. The N 2 0 4 reacted 
with the copper winding insulation and caused the coil wire to short, which was the proximate cause of 
the explosion. 



Discharge 

t 


Suction 


Impeller 


Re-Circulation 

Tubing 


Impeller 

Housing 


Figure 43-3: Pump Schematic 

Following the explosion, there were some design changes made to the pumps since an improper pump 
design was a root cause, these changes include the following: 

• Machining of the pump from a single billet of stainless steel rather than casting them 

• Serrations were added on the impellor housing and rear bearing housing for improved sealing 
capability 

• The addition of a thermowell for thermocouple monitoring rather than the old thermoswitch which 
proved to be unreliable 

This incident encouraged the Space Shuttle Program to consider alternate pump designs for its 
hypergolic propellant loading system. The centrifugal pumps at Pads 39A and 39B used for Space 
Shuttle hypergol loading were replaced with centrifugal pumps with the design changes listed previously; 
however, the changes did not completely mitigate the failure mode that caused the LC-40 pump to 
explode. This risk was accepted by the program and engineering team; although, it was mitigated by 
implementing the following controls: 

• Installing a blast cage around the pumps 

• Reducing the pump life requirements and performing maintenance checks every 60 hours of 
runtime for final two launches of Titan from LC-40 

• Rigorously testing the remaining pumps 

And at launch Pads 39A and 39B: 

• All pumps were removed and replaced following the LC-40 pump explosion 

• The pumps were leak checked using a helium mass spectrometer 

• A programmable logic controller was installed to deactivate the pump when the temperature 
reached 140 °F along with the normal health monitoring that has always been installed on the 
pumps 


Page 67 


NASA/TP-2009-214769 


• Run-times and start/stop times were tabulated to establish a baseline for a preventative 
maintenance program (removal and replacement is required once every 100 hours for oxidizer 
and every 150 hours for fuel) 

• Vibration analysis monitoring devices are installed on the pumps each time they are used 

o The data is evaluated and released in a formal report following the load 

There have been four other similar occurrences (three oxidizer pumps in 1963, 1964, and 1980 along with 
one fuel pump in 1962) throughout the history of the Titan program. The three failures in the 1960s were 
a result of incompatible bearing material, which was resolved, and the failure in 1980 was a result of a 
pin-hole leak in the stator liner can, which was mitigated by implementing a helium mass specification 
leak check. 

References: Crass; Comfort; 2003-224-00006 


44 HMF RP01 N 2 0 4 Spill (6/5/2004, KSC HMF M7-961 East Test Cell) 

On June 5, 2004, at the HMF M7-961 East Test Cell, a technician was exposed to a few drops of liquid 
N 2 0 4 . The drops ran down the technician’s glove and onto his left arm while attempting to reinstall a flight 
cap onto MD306 (RRCS oxidizer tank entry sump bleed) on RP01. The technician rinsed off his arm for 
about 20 minutes in a safety shower and was then sent to a local hospital. He was released later that 
day. There was not any reported hardware damage. The procedure included pre-operations for later 
testing of the RRCS helium system isolation valves, regulators, check valves, relief valves, and burst 
disks. 

The flight cap removal procedure began with the technician completing the bleed between the flight cap 
and the AHC (0.0697 in 3 for a 14-inch AHC and flight cap assembly), as the procedure stated. This 
process had the technician install a Tygon tube to the bleed port on the flight cap and run the tube into a 
nearby bucket of water. The two reasons behind the flight cap/AHC interstitial volume bleed are to vent 
off the small volume from any N 2 0 4 (N0 2 ) vapors that collect as a result of in-specification leakage of the 
poppet and to verify that the AHC poppet is not stuck in the open position. The two technicians working 
the operation were attired in the required PPE (hypergol compatible gloves, apron, chemical goggles, and 
face shield since the work was overhead). Supplied air respirators were on stand-by in case they were 
needed for any reason. 

When the bleed port was opened, the technician noted that he saw roughly the expected amount of 
oxidizer bubbles in the bucket of water. The two technicians monitored the bucket for about a minute at 
which time they reported that the bubbles had stopped. 

The technician then proceeded to remove the flight cap from the AHC (the proximate cause of the spill) at 
which time he noted that there was a slow liquid leak originating at the AHC poppet. The two technicians 
immediately upgraded their PPE to supplied air respirators and began to contain the leak with an active 
aspirator hose. The removed flight cap was not able to be reinstalled as a result of its degraded 
condition. The technicians requested a new cap be installed, which was subsequently brought into the 
test cell by the lead technician in street clothes. An attempt was then made to install the new cap without 
using the installation tool since this would require the technician to be located beneath the leaking AHC. 
It is claimed in the incident report that when this was attempted, the leak rate increased, as a result of a 
hydraulic lock from the presence of liquid between the AHC poppet and the flight cap, which had a closed 
bleed port. This does not seem to be realistic. The benefits of using the tool (the technician could install 
the cap much quicker and at an increased distance from the cap, reducing the likelihood of injury) are 
likely to out-weigh the risk, as long as the task was completed carefully. 

On a later attempt to install the flight cap, liquid N 2 0 4 ran down the glove of one of the technicians and 
onto his arm. It is believed that his skin was exposed to about two or three drops of oxidizer. He 
immediately located an eyewash station to run water over his arm for several minutes. Meanwhile, the 
other two technicians (one in PPE and one in street clothes) configured the aspirator hose using an 
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adhesive tape to contain any liquid that was released from the AHC. The three technicians then left the 
test cell and the exposed technician was sent to the hospital from which he was released back to work 
about 90 minutes later. 

SCAPE personnel arrived at the scene about four hours after the initial spill. They commenced with a 
procedure to connect a GHC to AHC MD306. Once the GHC was connected and the test cell was 
verified to have a 0.0 ppm breathing zone, the cell was opened for controlled work. 

The RRCS oxidizer tank was later drained for the AHC poppet replacement procedure. This operation 
was successfully completed. Following the spill, it was determined that roughly 1.4 gallons of N 2 0 4 
leaked through the MD306 poppet. The majority of this was contained using the aspirator. 

The incident report claims that the exposure may have been prevented if the procedure had been written 
more clearly and the technicians had been more knowledgeable of the chemistry that occurs when an 
N 2 0 4 system is vented (both possible root causes of the spill). The procedure directed the technician to 
vent (bleed) the volume between the AHC poppet and the flight cap for 15 seconds. The incident report 
goes on to say that the procedure did not specifically state that the volume should be vented for “no more 
than” 15 seconds; therefore, the technicians allowed the oxidizer in the interstitial volume to condense 
back into a liquid as a result of the dropping pressure and temperature during the vent. This theory is 
anecdotal and cannot be supported with any experimental or operational data. It was calculated that the 
leak rate of the N 2 0 4 from the AHC was approximately 22.7 cc/min of liquid. This amount of liquid would 
have been clearly evident in the bucket of water by a trained technician even though it was later noted 
that the piece of Tygon tubing that was used for the operation was old (opaque). 

The course of action taken following the initial spill (containing the spill as best as possible and then 
standing down until a SCAPE technician could continue the work) was likely the best possible solution at 
the time. The effort made by the technicians to reinstall the flight cap, thus containing the leaking AHC 
poppet, were noble; however, they put themselves at risk by installing the cap without the proper tool and 
completing the task without the appropriate PPE. 

The most probable cause indicated in the incident report was likely not the reason for the technicians not 
seeing any liquid N 2 0 4 exiting the Tygon tube. There is not a sufficient amount of data supporting or 
disputing the most probable cause presented in the report. Another possible scenario brought forth by 
NASA systems engineering was that the flight cap bleed port was blocked (partially or fully) by nitrate 
crystals that form when N 2 0 4 (or N0 2 ) within an iron or iron alloy containment vessel is given the chance 
to mix with humid air and then later dry up. Proper training of the engineers and technicians was a 
possible root cause of this incident; however, it remains unclear what the exact mechanism was behind 
the spill. The flight cap was tested following the incident and it was found that GN 2 was able to flow freely 
through the bleed port; however, nitrates could still have been present. They could have either dissolved 
in the liquid N 2 0 4 or were not large enough to constrict the GN 2 flow. 

Improvements that were implemented following this spill include using a new piece of Tygon tubing for 
every flight cap bleed, inserting a loop in the tubing, and creating a consistent flight cap removal operation 
between the HMF, OPF, and pads. 

References: Smitelli; 2004-162-00002 


45 WSTF N 2 H 4 Spill Following Manual Valve Failure (9/30/2005, WSTF TC 844B) 

On September 30, 2005, at WSTF TC 844B during a low pressure test, a 14-inch manual valve bonnet 
(handle) failed catastrophically. The failure caused the valve bonnet and stem to be ejected from the 
assembly, thus spilling approximately 74 gallons of liquid N 2 H 4 into the test cell (proximate cause of the 
N 2 H 4 spill). Most of the liquid N 2 H 4 was captured in the floor drains which were connected to a 1 ,500 
gallon secondary containment tank; however, some was lost as vapors into the air. There were no 
reported injuries. Figure 45-1 is a photograph of the lower bonnet fracture surface. 
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Figure 45-1: Lower Bonnet Fragment 


The failure began as an intergranular crack in the nickel-plated, aluminum bronze bonnet threads 
(fracture surface shown in Figure 45-1 ). It is believed that the crack began as a result of the ethylene 
propylene rubber and Teflon soft seals allowing corrosive agents to slowly leak into the thread region. 
Figure 45-2 shows a cross-section cutaway of the manual valve. The Teflon soft seals can be seen 
clearly near the middle of the threaded shaft. The corrosive agents reacted with ammonia, which came 
from the decomposition of N 2 H 4 (N 2 H 4 -> 1/3 N 2 + 4/3 NH 3 ). This accelerated the local corrosion and 
cracking. This was the first failure for this type of valve since they were procured and installed in several 
hypergolic systems at WSTF in 1994. 

The manual valve was used for the isolation of a leak-check leg of the “New Gas Generator Valve 
Module” subsystem in the Improved Auxiliary Power Unit (IAPU) system. This system is used to study 
long-term exposure of the IAPU to hydrazine under simulated Space Shuttle conditions. 

The valve had been cycled roughly 380 times and seen approximately 177 pressure cycles at around 400 
psia (the last 42 cycles were in 2005) since its installation in September of 1994. In 2005 testing began 
on the IAPU system using high-purity N 2 H 4 (rather than monopropellant grade N 2 H 4 ) to determine if there 
were any significant differences in the corresponding catalyst bed temperatures. High-purity hydrazine is 
defined as 99.5% pure N 2 H 4 . Monopropellant grade N 2 H 4 has a purity of 98.3%. During the testing, an 
internal leak was discovered in the system. The workaround of this internal leak was to alter the system 
valve configuration. The new configuration had the soon-to-be failed 14-inch manual valve in-line with the 
main catch tank and the bypass catch tank which resulted in a pressure of 50-psia on the manual valve 
that subsequently failed. While in this static configuration, the manual valve bonnet fractured and was 
ejected from the valve into the test cell, spilling the N 2 H 4 . The altering of the nominal configuration could 
be considered a root cause, along with the improper design (primarily material incompatibility) of the 
manual valve, itself. 

Immediately following the incident, the Automatic Dialing Alarm System (ADAS) began to call the 
responsible engineers and the WSTF fire department. The test cell was not being monitored by 
personnel at the time of the incident. The ADAS had detected a significant pressure drop over a short 
period of time in the test cell. No one was able to be reached with the automated system until the final 
call in the call sequence was made to the WSTF fire department. This call was made 16 minutes after the 
incident occurred. 
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| Fracture Location 


OUT OF FLOW MEOIA -permits 
without fluid contamination 
reduces operating torque . increases 
valve life. 

PANEL MOUNTABLE all Mark VIII valves 
are furnished with panel nuts. 

ONE PIECE STAINLESS STEEL STEM— elim- 
inates backlash, chattering and corro- 
sion due to contamination traps . 

flushing if required. 


ALL WETTED SURFACES 316 STAINLESS STEEL 

— corrosion-free performance for the 
life of the valve 

BRONZE NICKEL PLATED BONNET— resists 
corrosion, minimises torque. 


SUPERIOR SOFT-SEAT DESIGN — 

large sealing area of the captive, 
resilient insert and broad valve seat 
assures bubble-tight shutoff and 
exceptionally long valve life 

LARGE FLOW PASSAGES -minimize 
pressure drop through valve Choice 
of C v values of .25 to 1,60 depend ing 
on valve size and body style. 

riAT-FACID 0 RING SEALED FITTINGS 

union-type Mark VIII O-SEAL fittings 
assure leakproof connections that 
won't vibrate loose valve can be 
slipped in or out without 
springing or cutting the line. 

HERMETICALLY SEALED TUBE ENDS— 

Mark VIM O-SEAL fittings are permanently 
brazed or welded to the tubing. 

Other valve end configurations are 
available. See pages band 7. 


Figure 45-2: Schematic of Failed Manual Valve 


The response of the personnel following the incident could have been better. However, proper steps 
were taken to evacuate all non-essential personnel from the area and activating the TC 844B exhaust 
fans about one hour after the incident following an assessment of the wind direction. Several different 
personnel noted that they saw smoke or vapors exiting the test cell underneath doors and out the exhaust 
vents. It was also noted that the vapors in the test cell were so dense that local cameras were unable to 
obtain a clear image. The water deluge system was only activated for three minutes (at a flow rate of 1 50 
gpm) in the test cell (in attempt to dilute the N 2 H 4 ) to reduce the risk of damage to the test equipment and 
the possibility of a fire. This added approximately 450 gallons of water to the secondary containment 
tank. There was no evidence of a fire or explosion during a post-incident inspection. It would not have 
taken much for an ignition with the reported density of N 2 H 4 vapors in the test cell prior to the activation of 
the water deluge system. The mean temperature on Friday, September 30, 2005 was 72 °F. If it had 
been warmer, the outcome of this incident could have been much worse. 
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Test cell 844 has been exclusively an APU component test bed since 1994; therefore, it was designed for 
fuel only and there were no considerations for oxidizer spills. The secondary containment tank and the 
water deluge system were part of the overall system/facility design. Those portions of the system worked 
as they were intended once the decision was finally made to activate the water deluge. The containment 
tank was sampled and the water/N 2 H 4 mixture was pumped into barrels, and sent off-site to an incinerator 
for disposal. There was no cleaning completed on the secondary containment tank following the N 2 H 4 
spill. 

The incident report stated that the following items are contributing factors to the manual valve bonnet 
failure by environmentally assisted cracking with the final two primary bullets being the root causes 
(improper GSE component design): 

• Intermediate stress on the nut established during valve assembly 

• System loading pressure on nut 

• Closing preload on nut 

• Corrosive environment present at thread surface 

o Hydrazine, air, ammonia, and carbazic acid were present at the failure location 

• The nickel plating on the aluminum bronze components was not as effective at corrosion 
prevention as advertised by the valve manufacturer 

• Damaged seals allowed corrosive agents into thread region 

o Marginal triangular seal gland design 

o The ethylene propylene rubber seals degraded from long-term N 2 H 4 exposure 
o The rubber seal “groove" was not large enough to hold a seal that had absorbed N 2 H 4 
o Preventative maintenance/mechanical integrity plan did not consider soft good life 
o Permeation of the seals allowed corrosive agents into thread region 

• Material compatibility for non-wetted components was not considered during valve procurement 

The incident report stated that the following were not contributing factors to the failure: 

• Excessive force on bonnet nut 

• Cleaning solution present (mainly Oakite solutions which decompose into phosphorus oxides) 

• Damage during valve assembly 

• Foreign object debris present 

• Over-stressing of bonnet components 

Reference: Kowalski; Porter 


46 STS-121 FRC3 N 2 0 4 Spill (1/9/2006, KSC HMF M7-1212 West Test Cell) 

On January 9, 2006, an N 2 0 4 spill occurred (approximately 2.9 gallons) in the HMF M7-1212 West Test 
Cell on the 10-foot level. This occurred when the FRC3 AHC poppet assembly for MD122 (FRCS 
oxidizer propellant tank lower compartment channel bleed) was being removed and replaced (proximate 
cause). Two technicians were evacuated from the building and sent to the OHF following the scent of 
N 2 0 4 in their SCAPE suits. Two other involved technicians were sent to the OHF as a precaution. It was 
determined that all four had no injuries. It was also determined that the SCAPE suits had not failed (e.g. 
they did not have any holes in them). There was notable damage to flight hardware and ground support 
equipment in the test cell. Several PRs were opened during the cleanup process on the following 
systems: TPS, TCS, STR, OHE, ORH, and OEL/INS. 

A few opinions were brought forth as to the possible cause of the spill. It is unknown if one single event 
caused the liquid to fill the MD122 line and spill into the M7-1212 west test cell or if it was a combination 
of several different events. Operational human error was designated as the root cause of this incident as 
a result the engineering team incorrectly predicting the response of the vehicle system during the removal 
and replacement procedure. 
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With the vehicle in a horizontal orientation, the MD122 line runs from the high point of the oxidizer tank 
lower compartment channel, through an interface at the tank outlet flange, and out to an AHC located in 
an externally accessible door on the FRCS outer mold line (AP28-00 door). It is known through pressure 
measurements that the MD122 and MD120 connected GSE lines were clear of any liquid immediately 
following the two, five-minute purges; however, it is not known if the propellant acquisition system channel 
in the lower compartment was broken down (i.e. it did not contain any liquid). If the screen was not 
completely broken down, it is possible that liquid oxidizer “wicked” up the screen following the purges to 
the point where MD122 connects to the acquisition screens. See Figure 46-1 for visual aid of the 
propellant acquisition system screens and the MD122 line. The absence of liquid in the lines can be 
confirmed by noting that there was not any significant pressure increase in the lines. The tank was not in 
thermal equilibrium. The tank shell (skin) temperature rose from 49 °F, when tank venting was complete, 
to 58 °F, when MD124 GSE vent valve was opened for the emergency vent through MD124 in the upper 
compartment of the tank. When the two purges were complete the tank shell temperature was 54 °F. 
From the time of the spill to the emergency MD124 vent, the tank shell temperature rose from 57 °F to 58 
°F. The fluid and gas temperatures likely rose by a degree or two during this time. 



Figure 46-1: Solid Model of RCS Propellant Tank in (Roughly) the Horizontal Orientation 

At the time of the spill there were three pressure transducers online for use. All three pressure 
transducers indicated no change until just after 12:29 PM when the oxidizer tank out pressure toggled 
down 1.6 psi from 14.4 psia to 12.8 psia. The venting of the tank through MD124 took place at 12:27:24 
PM. This, however, does not mean that the tank pressure was not in flux. As a result of the coarse data 
resolution, the oxidizer tank out pressure could have been changing within a range of +/- 1 .6 psi. 

Prior to the spill, it was determined through x-ray analysis that the N 2 0 4 propellant tank contained 19.5 
gallons of N 2 0 4 . Following the spill, it was determined that 2.9 gallons of N 2 0 4 had been lost through the 
venting process and the spill itself. 

In the hours and days following the spill many problems were reported as a result of the N 2 0 4 (N0 2 ) 
vapors reacting with different materials on the Space Shuttle forward module. A photograph of the 
module following the spill is shown in Figure 46-2. Damage to the Koropon structural coating can be 
seen along with a couple of missing thermal tiles. A total of ten thermal tiles (highlighted in yellow in 
Figure 46-2) were later removed and replaced before the perimeter of the spill was bounded. Other PRs 
were taken to assess issues with wiring and Neoprene adhesive wraps that are used to attach wires to 
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tubing and are known to react with N 2 0 4 (N0 2 ) vapors and cause corrosion on stainless steel tubing 
through chloride attack. 



Figure 46-2: FRC3 Following Spill (Replaced Tiles Highlighted in Yellow) 


The spilled oxidizer appears to have reacted with Koropon, RTV, and silver plating (nutplates and barrel 
nut elements). The oxidizer vapors reacted with the Koropon and removed a large area, as shown in 
Figure 46-3, and passed through the nutplate holes and around the perimeter of the phenolic QD service 
panel into the interior of the FRCS module, as shown in Figure 46-4, causing damage to the Koropon on 
the interior side of the FRCS module. 



Figure 46-3: View Looking at R/H Side Down-Firing Thrusters (F2D & F4D) 
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Figure 46-4: Koropon Damage on Interior of FRC3 Below AP28-00 Door 


The spill also caused damage to a few thermal blankets located within the FRCS module. The primary 
visible effect on TCS blankets when exposed to N 2 0 4 (N0 2 ) vapors is the degradation of the thin metallic 
foil coating. Depending upon the amount of exposure, this effect can be delayed. The blankets were 
evaluated two days after the spill occurred, and three blankets were identified as contaminated. These 
blankets were removed. The remaining blankets were evaluated later with further degradation noted. 

A report was put together by HMF USA OMS/RCS engineering management following the input from a 
four-panel-member board, which included one NASA representative. The purpose of the report was to 
summarize the spill event and form recommendations to improve processes in the future. Two findings 
and five observations were noted in the report. A summary of the findings/observations and 
recommendations are tabulated in Table 46-1. Following the table are several observations put forth by 
NASA OMS/RCS engineering. 


Table 46-1: Committee Report Findings/Observations and Recommendations 


Findinq/Observation 


Recommendation 


Procedure was reviewed and alternative purge 
processes were discussed in house by NASA/USA j 
engineering system experts. 

j 


Evaluate and develop alternative methods to reduce 
risk of liquid release. Evaluate process for 
independent review of complex hazardous tasks 
using the First Article Review Process. 


Failure to develop contingency plans in the event 
of unexpected liquid release. 

Personnel reported smell of oxidizer in SCAPE 
suit and reported to the test team. Each member 
of the test team directed the potentially exposed 
employee to leave the work area. Employee 
egressed after the third request to leave the test 
cell. An employee in the relief SCAPE crew stated 
later that he smelled oxidizer in his SCAPE suit, 
but failed to report it to the test team. 


i Include Emergency Procedures for unexpected liquid 
! release. 

! Brief individuals involved in the SCAPE operation on 
I the proper response to possible hypergolic 
j contamination inside the SCAPE suit. Re-emphasize 
I training in removing individual from contaminated 
j area, (squat and squeeze), report anomaly, depart 
I area, perform individual change out, and maintain the 
I buddy system. 
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Findinq/Observation 

Recommendation 

Multiple occurrences of SCAPE discipline 
breakdown; breathing air was not maintained 
either by air bottle or hardline and communication 
between SCAPE personnel and test team was not 
maintained. 

Management to brief individuals involved in the 
SCAPE operation on the importance of maintaining 
positive breathing air and communications at all 
times. 

Test Team evaluated the hazardous conditions 
and determined the safest course of action was to 
complete the entire operation, including the clean- 
up of released oxidizer prior to mishap evaluation. 
Unexpected oxidizer release was reported to 
Safety Console and HMF Management. Witness 
statements and data collection commenced 
without delay, and were completed by the end of 
shift. 

Conduct Post Test review and evaluate test team’s 
actions for compliance of a USA operating procedure 
related to Reporting, Investigating, and Resolving 
Mishaps. 

Test team performed an engineering risk 
assessment during the development of the outline 
and table top reviews however failed to document 
per the SFOC Risk Assessment process. 

Review First Article TOP development process. 

Spill Protection did not adequately contain quantity 
of defined credible spill and failed to protect 
adjacent hardware from oxidizer release. 

Evaluate Spill protection process and develop desk 
instructions to ensure proper level of spill protection 
corresponds to reasonable risk of release. 


Observation 1 - QC and Safety Presence During Disposition Development 

Quality and safety were not involved in the preliminary disposition meetings. 

Observation 2 - Verification Ruling Out the Presence of Liquid Not Pursued 

The addition of a sight glass into GSE to positively rule out the presence of liquid N 2 O 4 in the fluid lines 
might have been beneficial. If not the sight glass, there should have been some other verification method 
or procedure that took place to ensure that there was no liquid present in the lines prior to the 
disconnection of any hardware. 

Observation 3 - Low Pressure Purges 

The purges were completed at 2-4 psig because, at the time, it was thought that the requirement of 4.6 
psid across the tank bulkhead (solid structural interface between the tank’s upper and lower 
compartments) would be violated. This was actually not true because any increase in pressure would be 
relieved through either the compartment transfer tube or the vent through MD120. The propellant tank 
screens test purge procedure, which is very similar, called for 30-40 psid for no less than (NLT) five 
minutes. A separate PR, in which MD120, MD122, and MD124 AHCs were rebuilt and MD120, MD122, 
and MD178 tank fittings were removed and replaced used a purge pressure in through MD122 and out 
MD120 of 4-8 psid for ten minutes. 

Observation 4 - Purge Lengths 

It would probably have been advantageous to do the two purges for longer than five minutes. The 
propellant tank screens test purge length was NLT five minutes, but it was often done for ten or even 
fifteen minutes and the FRC5 PR mentioned in Observation 3 required a purge time of ten minutes. 

Observation 5 - Spill Protection 

The spill protection in the area around the AP28-00 door was inadequate and not capable of containing 
the maximum credible spill quantity. 


Page 76 






NASA/TP-2009-214769 


Observation 6 - Aspirator and Vent Linked to Same System 

The aspirator utilizes nitrogen flow that exits to the vent system, thus increasing the vent system’s 
pressure. This could lead to vent gas migrating into the vented flight propellant tank; however, this has 
not been proven. There is concern that this would introduce moisture into the oxidizer tank thus 
increasing the likelihood of damage to tank components through corrosion. 

Observation 7 - Hypergol Exhaust Fans Were Not Used 

The M7-1212 West Test Cell hypergol exhaust fans were not used following the spill because of a 
concern that the tank isolation valves would back relieve some unknown amount of liquid into the lower 
compartment of the tank as a result of temperature increases in the test cell. It was believed that this 
increase in cell temperature would cause a pressure increase in the lines between the tank isolation 
valves and the thruster valves (the manifold isolation valves were open). The actual amount of liquid that 
would have been back relieved was later found to be approximately a few cubic inches of liquid N 2 0 4 . In 
hindsight, use of the exhaust fans in the event of a spill should have been studied in detail and discussed 
at the table-top meetings during the procedure development and communicated to the test team during 
the pretest briefing. 

Observation 8 - Emergency Safing 

There was no pre-planned provision that enabled closing of the AHC should the need arise, as in this 
instance. 

Since the spill occurred, a very similar procedure was successfully completed on forward module FRC3 
again. Engineers and technicians completed the procedure review and operation with the lessons 
learned from the 2006 FRC3 spill in mind. 

References: Nufer; Keinath; 2006-027-00002 


47 Conclusion 

Many hypergolic related incidents have been discussed. A quick summary of the incidents mentioned 
previously can be seen in Appendix B: Summary of Incidents. Some common lessons learned deduced 
from the various root causes are shown in the following list. If these items were properly addressed prior 
to the incidents, prevention may have been possible (in hindsight) or the impact or consequence of the 
incident could have been reduced. 

• Improper configuration control and internal or external human performance shaping factors can 
lead to being falsely comfortable with a system 

o Vent systems are often neglected and treated as non-hazardous even though they can 
capture and contain hypergolic liquids (especially in low points) 

o Aging support hardware should be routinely inspected to reduce the risk of a failure 
during critical operations 

• Communication breakdown can escalate an incident to a level where injuries occur or hardware is 
damaged 

• Improper propulsion system and ground support system designs can destine a system for failure 

o Low points in GSE should be designed out 

• Improper training of technicians, engineers, and safety personnel can put lives in danger 

o Inadequate knowledge of electrostatic discharge while working fuel operations can lead 
to a fire or explosion 

o Knowledge of transducer offsets is very important for system oversight 

o Unknown incompatibilities (from lack of training or research) with propellants can cause 
surprising failures 

o If an incident does occur, the system should immediately be placed into a stable 
configuration; following this, the procedure should be stopped to assess the 
problem and its possible ramifications 
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o A heightened amount of situational awareness of technicians and engineers working 
operations can reduce the risk of an incident and decrease the possibility of injuries or 
damage if an incident does occur 

• Improper PPE, spill protection, and staging of fire extinguishing equipment can result in 
unnecessary injuries or hardware damage if an incident occurs 

• Improper procedural oversight, development, and adherence to the procedure can be detrimental 
and quickly lead to an incident 

o Improper emergency procedures can increase the risk of injuries or hardware damage 

• Improper local cleanliness or housekeeping (for example iron oxide or rust) can result in fires or 
explosions 

• A thorough hypergol system evacuation should be completed (wherever a vacuum is tolerable by 
the system) prior to the removal or disconnection of any hypergolic propellant fittings 

o A pulse purge has proven to be inadequate for the removal of residual propellants 

Table 47-1 and Figure 47-1 summarize the fuel and oxidizer incidents. Note that if the numbers in the 
table are totaled, they do not sum to the total amount of fuel and/or oxidizer spills summarized in this 
document. This is a result of some incidents having injuries and a fire or multiple root causes, for 
example. A larger, more extensive list of the data shown in Table 47-1 can be seen in Appendix C: 
Detailed Assessment of Incidents. 


Table 47-1: Hypergol Spill and Fire Summary 


Oxidizer Incidents: 

Fuel Incidents: 

23 

Total (Liquid and Vapor) 

24 

Total 

7 

Vapor Only 

8 

Led to a Fire 

3 

Led to a Fire 

2 

Led to an Explosion 

3 

Led to an Explosion 

7 

Led to Injuries (minor to d< 

8 

12 

Led to Injuries (minor to death) 
Led to Hardware Damage 

12 

Led to Hardware Damage 


10 Oxidizer/Fuel No Hardware Damage or Injuries 

Root Causes: 

7 Procedure Adherence/Control (engineer or technician did not follow procedure or protocols were ignored) 
1 1 Improper Personnel Training (engineers or technicians were untrained or too inexperienced) 

17 Human Error (technician and/or engineers making a real-time error) 

24 Improper GSE/Vehicle Design (improper materials, unknown low points, incompatibilities, etc.) 

1 1 Improper Configuration Management (system configuration and upkeep errors that led to an incident) 
Incident Occurred During: 

18 During Commodity Movement 
15 During an R&R Procedure 

41 During a Nominal Hypergol Operation 
13 During Opened Hypergol System 
3 In a Static Hypergol System 
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Distribution of Root Causes 



□ Procedure Adherence/Control 

□ Improper Training 

□ Human Error (Operations) 

□ Improper GSE/Vehicle Design 

■ Improper Config. Management 


Distribution of Time of Incident 


3 



□ During Commodity Movement 

□ During R&R 

□ During Hypergol Operation 

□ During Opened System 

■ During Static Configuration 


Figure 47-1 : Distributions for Root Cause and Time of Incidents 


Some lessons learned from the Apollo program related to hypergol loading equipment according to J. 

Tribe include: 

• On-board vehicle instrumentation was limited to that required for flight evaluation; this dictated 
use of GSE instrumentation to monitor critical vehicle parameters during ground operations-a less 
than desirable configuration 

• Operational visibility from the control room was minimal and there was extensive reliance on 
technicians (usually in SCAPE) to read gages correctly and position multiple manual valves 

o The servicing and test disconnects on the command and service module (CSM) were 
challenging to manually position correctly 

o This inevitably led to a mis-configuration on Apollo 16 that resulted in a CM RCS tank 
ruptured bladder, roll back of the Saturn V stack and de-stack of the CSM and lunar 
module; lack of flight system instrumentation was a direct contributor to this event 

• As the design matured, configuration changes increased complexity for ground operations and 
greatly extended servicing timelines 

o SM RCS changes from individual block 1 “quads” to block 2 to the propellant storage 
module installation are an example (8 tanks to 16 tanks to 25 tanks) 
o Each “quad” was a stand-alone system until the propellant storage module 
interconnected them 

• Multiple individual tanks on CSM required multiple access panels and disconnects 

o Compare: # of tanks # of servicing panels # of disconnects 

CSM Skylab 31 22 56 

Shuttle OMS/ARCS 8 2 22 

o This multiplicity resulted in a complex ground servicing operation with an extensive fluid 
distribution system, valve boxes, bleed units, ullage cylinders, purge panels and the need 
for a weather-protected 360 degree access 
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• Apollo servicing operations required a variety of loading methods - mostly sequential and time- 
consuming 

o SPS fill used on-board gauging/totalizer to determine flight loads 
o RCS fill used a combination of evacuated tanks with load by weight and fill to overflow, 
removal of a specified ullage and a manual PV determination to confirm flight loads 
o Flight loads were accurate but the methods were time-consuming 

• During the life of the program, significant propellant spills (especially during Apollo 7 preps) drove 
increased need for spill collection and containment 

o The installation of improved scuppers at vehicle interfaces and facility precautions were 
complex and time-consuming 

• Different fuels for different flight systems (A-50 and MMH) doubled the number of servicing units 
and fluid distribution systems 

• The Space Shuttle Program corrected many of these deficiencies with 

o Remotely controlled operations from the LCC 
o Extensive use of software loading programs 
o Remotely operated disconnects and leak checks 
o Gang servicing valve disconnects for OMS and ARCS 

Some type of human error can be traced to nearly every studied incident as a root cause, whether it be 
an error in the design phase or an error prior to or during operational use of hardware containing 
hypergols. Humans are most definitely not perfect and even when the most knowledgeable personnel 
are intimately involved in the design phase (vehicle or GSE) or during an operation, mistakes can be 
made and critical items can be overlooked. One can deduce, however, that most incidents happen during 
some sort of dynamic operation. Hypergols tend to be very stable in a static configuration (as long as the 
compatibility characteristics have been well addressed). At the end of the day, an appropriate quote 
related to the majority of hypergolic spills and fires comes from the 9/1 1 Commission Report, “The most 
important failure was one of imagination.” 

Advance warning (prior to any liquid or vapor release) was available in several of the incidents to the 
technicians in the vicinity of the spill and/or the engineers that were monitoring from a remote location. 
The warning indications include off-nominal data (remote or local), off-nominal system characteristics, 
and/or local changes that occurred without human intervention. Some of these went unnoticed or were 
ignored during the operation, thus resulting in an incident. There was advance warning in 19 out of 38 
total incidents (50% of the time). This percentage does not include spilled fuel as an advance warning of 
a fire (5 occurrences). Depending on the local environment, there is a reasonable probability that if 
hydrazine (or one of its derivatives) is spilled, there will be a fire; therefore, the fuel spill itself is an 
advance warning of a fuel fire. Roughly 42% of the fuel fires documented in this report resulted in a fire 
or explosion. The Titan IV K-9 N 2 0 4 spill likely had an advance warning; however, there was no one in 
the vicinity of the indications to receive the warning, therefore, this was not included in the above 
percentage along with the OV-101 APU spill in 1977, since it was unable to be determined if there was an 
advanced warning for this incident. Located in Appendix B: Summary of Incidents is a summary of the 
advance warnings for each incident (if there was one). 

Hypergolic rocket propellants have proven to be a highly reliable asset in manned and unmanned space 
flight; however, their maintenance on the ground has proven to be relatively difficult. Do the operational 
risks from possible human errors or hardware failures causing a catastrophic incident outweigh the 
usefulness of hypergols even though they have been used for the last 50 years of manned and 
unmanned spaceflight? One would have to say probably not, since hypergols are so widely used in the 
space industry currently and are being proposed to be used on many vehicles in the future. Therefore, 
ground operations on hypergol systems have become increasingly scrutinized for possible unknowns, 
and rightfully so. The data shown in this report are not an example of why we should not be using 
hypergolic propellants on spacecraft and launch vehicles, but rather what we can and should do to 
mitigate possible unforeseen ground operation and/or design problems. 
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49 Appendix A: Acronyms and Abbreviations 


ACGIH 

TLV-TWA 

American Conference of 
Governmental Industrial 
Hygienists Threshold Limit Value 
Time Weighted Average 

ADAS 

Automated Dialing Alarm System 

AFB 

Air Force Base 

AHC 

Air Half Coupling 

Al 

Aluminum 

ANSI 

American National Standards 
Institute 

APU 

Space Shuttle Auxiliary Power 
Unit 

ARCS 

Space Shuttle Aft Reaction 
Control System 

CAIB 

Columbia Accident Investigation 
Board 

cc 

Cubic Centimeters 

CCAFS 

Cape Canaveral Air Force Station 

Cp 

Commercially Pure (in reference 
to Titanium) 

Cr 

Chromium 

Cres 

Corrosion Resistant Steel 

CSM 

Command and Service Module 

DOT 

Department of Transportation 

EAFB 

Edwards Air Force Base 

EMV 

Electromechanical Valve 

°F 

Degrees Fahrenheit 

F#Letter 

L#Letter 

R#Letter 

Space Shuttle Thruster 
Reference Designator (F means 
FRCS, R means RRCS, L means 
LRCS; middle number is the 
manifold; and the last letter is the 
thruster direction D (down), U 
(up), L (left), R (right), F 
(forward), or A (aft)) 

FCV 

Flow Control Valve 

FRC# 

Space Shuttle Forward Reaction 
Control Module Number # 

FRCS 

Space Shuttle Forward Reaction 
Control System 

ft 

Foot 

gp m 

Gallons Per Minute 

GSE 

Ground Support Equipment 

GHC 

Ground Half Coupling 

gn 2 

Gaseous Nitrogen 

HMF 

KSC Hypergolic Maintenance 
Facility 

HN0 3 

Nitric Acid 

HONO 

Nitrous Acid 

HPU 

SRB Hydraulic Power Unit 

HTH 

High Test Hypochlorite(industry 
trademark) 


IAPU 

| Improved Auxiliary Power Unit 

ICBM 

| Intercontinental Ballistic Missile 

IPR 

I Space Shuttle Interim Problem 
{ Report 

ILC 

I International Latex Corporation 
| Suit (similar to SCAPE suit) 

INS 

j Space Shuttle Instrumentation 

IRIS 

| Incident Reporting Information 
i System 

JSC 

j NASA Johnson Space Center 

KSC 

j NASA Kennedy Space Center 

lb(s)(m) 

j Pounds (mass) 

LC 

| Launch Complex 

LCC 

j KSC Launch Control Center (also 
1 called “the firing room’’) 

LPO# 

| Space Shuttle Left OMS/RCS 
| Pod Number #(LP01, LP03, 

1 LP04, LP05 {destroyed STS- 
! 107}) 

LPS 

I KSC Launch Processing System 

LRCS 

j Space Shuttle Left Pod RCS 

LSOC 

j Lockheed Space Operations 
! Company 

LV01 

| Original Left OMS/RCS Pod of 
! the Space Shuttle (destroyed 
i STS-51L) 

MD### 

! Manual Disconnect Number # 
j from Space Shuttle OMS/RCS 

MEK 

| Methyl Ethyl Ketone 

MER 

j JSC Mission Evaluation Room 

MLI 

| Multi-Layer Insulation 

MLP 

j KSC Mobile Launch Platform 

MMH 

j Monomethylhydrazine 

MON 

| Mixed Oxides of Nitrogen (N 2 0 4 ) 

N 2 H 4 

| Hydrazine 

n 2 o 4 

j Nitrogen Tetroxide 

NASA 

j National Aeronautics and Space 
j Administration 

NIOSH 

j National Institute of Occupational 

REL 

| Safety and Health Recommended 
| Exposure Limit 

no 2 

| Nitrogen Dioxide 

NLT 

| No Less Than 

NPR 

I NASA Procedural Requirement 

OD 

| Outer Diameter 

OEL 

| Space Shuttle Orbiter Electrical 

OHE 

| Space Shuttle Orbiter Handling 

OHF 

| KSC Occupational Health Facility 

OIS 

| KSC Operational 
1 Intercommunication System 
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OMDP 

Space Shuttle Orbiter 
Maintenance Down Period (long 
duration down-time for detailed 
repairs and testing) 

OMI 

KSC Operations and 
Maintenance Instruction 
(permanent, heavily scrutinized, 
and regularly ran work 
instruction) 

OMS 

Space Shuttle Orbiter 
Maneuvering System (6000 lb 
thrust rockets) 

OP 

Operating Procedure 

OPF 

KSC Orbiter Processing Facility 

ORH 

Space Shuttle OMS/RCS HMF 

ORSU 

WSTF Oxidizer Ready Storage 
Unit 

OSHA 

(PEL) 

Occupational Safety and Health 
Administration (Permissible 
Exposure Limit) 

OTV 

KSC Closed Circuit Television 

O V-### 

Space Shuttle Orbiter Vehicle 
(OV-099 was Challenger, OV-101 
was the Enterprise test vehicle, 
OV-102 was Columbia, OV-103 is 
Discovery, OV-104 is Atlantis, 
and OV-105 is Endeavour) 

p 

Pressure 

PPE 

Personal Protective Equipment 

PPm 

Parts Per Million 

PR 

Problem Report 

PRACA 

Problem Reporting and 
Corrective Action (used for 
tracking Space Shuttle problems) 

PROS 

Space Shuttle Primary Reaction 
Control System (870 lb thrust 
rockets) 

psi(a)(d)(g) 

Pounds Per Square Inch 
(atmospheric) (delta) (gage) 

PVC 

Polyvinyl Chloride (form of 
plastic) 

QC 

Quality Control 

QD 

Quick Disconnect 

R 

Rankine 

R&R 

Remove and Replace 

RCS 

Space Shuttle Reaction Control 
System 

RFHCO 

Rocket Fuel Handler Coverall 
Outfit (similar to a SCAPE suit) 

RPO# 

Space Shuttle Right OMS/RCS 
Pod Number# (RP01, RP03, 
RP04, RP05 {destroyed STS- 
107}) 

RRCS 

Space Shuttle Right Pod RCS 


RTF 

| Space Shuttle Return to Flight 
(Post STS-51L and STS-107) 

RTV 

| Room Temperature Vulcanization 
{ (adhesive) 

RV01 

j Original Right OMS/RCS Pod of 
! the Space Shuttle (destroyed 
! STS-51L) 

SCA 

j Space Shuttle Carrier Aircraft 

SCAPE 

I Self-Contained Atmospheric 
! Protection Ensemble 

SFOC 

| Space Flight Operations Contract 
| (NASA contract with USA) 

SIP 

| Strain Isolator Pad 

SLC 

| Space Launch Complex (also 
{ referred to as LC] 

Sn 

1 Tin 

SPS 

| Service Propulsion System 

SRB 

| Solid Rocket Booster 

SRM 

| Solid Rocket Motor 

SS 

I Stainless Steel 

STR 

1 Space Shuttle Structures 

STS 

j Space Transportation System 

T 

| Temperature 

TC 

| Test Cell 

TCS 

1 Space Shuttle Thermal Control 
[ System 

Ti 

| Titanium 

TLV 

j Threshold Limit Value 

TOP 

j Technical Operating Procedure 

TPS 

| Space Shuttle Thermal Protection 
1 System 

TPS 

i Test Preparation Sheet 
1 (temporary work instruction) 

TS 

| Test Stand 

TTA 

| JSC Thermochemical Test Area 

TVC 

| Thrust Vector Control 

TVC 

| Toxic Vapor Check 

TWA 

| Time Weighted Average 
1 (reference TLV) 

UDMH 

! Unsymmetrical Di- 
| Methylhydrazine 

USA 

| United Space Alliance 

USAF 

| United States Air Force 

USSR 

i Union of Soviet Socialist 
1 Republics (former Soviet Union) 

V 

j Vanadium 

VAFB 

| Vandenberg Air Force Base 

Vp 

j Vapor Pressure 

wc 

j Tungsten Carbide 

WJI 

| WSTF Job Instruction 

WSI 

j WSTF Standard Instruction 

WSTF 

j NASA JSC White Sands Test 
j Facility 
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50 Appendix B: Summary of Incidents 

The proceeding table is a summary of all the credible spills and fires included in this report along with their respective dates, locations, a short 
description, and primary lessons learned. 


Incident 

Date 

Location 

' TirrrT — 1X1 ■ 

Description 

Advance Warnina 

1 Primary Lesson(s) Learned 

Apollo 7 SPS 
N 2 0 4 Spill 

Sept. 1968 

CCAFS LC-34 

Inadequate purges resulted in 
the collection of liquid N 2 0 4 in a 
tubing low point, technician was 
removing a panel when about 1- 
2 gallons of liquid N 2 0 4 spilled 
onto the vehicle and 
surrounding structure, some 
vehicle damage, no reported 
injuries 

None 

! Spill protection is necessary 
1 in a hypergolic propellant 
1 transfer operation, do not 
1 attempt to dilute liquid N 2 0 4 
| with water, and tubing low 
! points should be eliminated 
Ifrom GSE in the design phase 

j 

Apollo-Soyuz 
Astronaut N 2 0 4 
Vapor Exposure 

J 

7/24/1975 

Apollo-Soyuz 
Test Project 
Apollo Command 
Module Reentry 

During reentry the astronauts 
performed a few tasks out of 
sequence leading to ingestion of 
N 2 0 4 (N0 2 ) vapors into the crew 
module 

None 

i 

i 

| Performing tasks out of 
j planned sequence can lead to 
1 unexpected results 

OV-101 APU 1 
Cavity Seal N 2 H 4 ! 
Spill 

6/28/1977 

During second 
captive-active 
test flight of 
Enterprise 

Approximately 5 gallons of N 2 H 4 
spilled onto the side of the 
vehicle and in through the vent 
doors when a shaft seal failed, 
some flight hardware damage 

Unknown if the leak 
resulted in a pressure drop 
visible in the cockpit or from 
the ground 

1 Kapton and N 2 H 4 are not 
1 compatible, some 
I components of the APU 
1 system were redesigned 

Titan II Silo Large 
Scale N 2 0 4 Spill 

8/24/1978 

McConnell AFB 
Silo 533-7 

The worst known N 2 0 4 spill in 
U.S. history where 
approximately 13,450 gallons of 
liquid N 2 0 4 spilled into a missile 
silo killing 2 and injuring 25, 
caused by o-ring seal lodging in 
AFIC poppet, filter was missing 
from system to catch the o-ring 

None 

| 

j Proper configuration control of 
j GSE components, in this case 
j the filter, is highly important in 
j the handling of toxic 
i chemicals especially 
! hypergols 

■ 

N 2 H 4 Spill 
Following APU 
Hotfire 

Nov. 1979 

KSC OPF1 

N 2 H 4 dissolved brass in a “gage 
saver” spilling a couple gallons 
of N 2 H 4 , no reports of injuries or 
damage 

None 

! Unknown incompatibilities can 
j lead to surprising spills during 
j an operation or while in a 
! static configuration 
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Incident 

Date Location 

Description 

Advance Warnina i Primary Lessonfs) Learned 

Titan II Explosion 
Following A-50 
Spill 

9/1 8/1 980 1 AFB 

y/io/iyou | Si | 0374 _ 7 

i 

i 

i 

i 

! 

A technician dropped a large 
socket 70 feet, it bounced into 
the Titan II rocket piercing the A- 
50 propellant tank, spilled about 
11,140 gallons of fuel which 
later ignited causing the N 2 0 4 
propellant tank to rupture 
causing a large explosion killing 
one and injuring 21, the silo and 
rocket were damaged beyond 
repair 

Fire was imminent as a 
result of the quantity of fuel 
that had spilled 

All workers should wear a belt 
with lanyards to attach tools, 
care should be taken to 
ensure the exclusive use of 
explosion proof hardware in a 
facility that contains 
hypergolic propellants, 
sending personnel into an 
unknown situation is 
extremely dangerous 

KSC Incorrect 
Flight Cap N 2 0 4 
Vapor Release 

i 

! i 1 

! 

! July 1981 IKSCOPF1 

! 1 

1 : 1 

! 1 1 

i -1 

A 14-inch AHC cap was placed 
onto a 14-inch AHC causing the 
poppet to depress and the 
release N 2 0 4 (N0 2 ) vapors, 
minor injuries, no hardware 
damage 

14” flight cap design is 
noticeably different than a 
y 2 ” flight cap 

An incorrect tag was attached 
to the flight cap and the 
number etched on the cap 
was sanded off in attempt to 
remove corrosion 

MMH Exposure 
Following 
Flexhose 
Removal at Pad 
Farm 

i i 

i 

7/14/1981 |KSCPad39A 
i Fuel Farm 

| 1 

i 1 

; 

A technician removed a 
mislabeled flexhose resulting in 
an MMH spill, minor injuries, no 
hardware damage 

None 

Flexhose was not labeled as 
hazardous and procedure 
was not properly scrutinized 

STS-2 OV-102 
Right Pod MMH 
Fire 

| 

Fall 1981 I KSC OPF1 

i 

I | 

Small amount of MMH dripped 
onto gold MLI blanket causing 
ignition, no injuries, minor flight 
hardware damage 

Fire was possible as a 
result of spilled fuel 

Ignition properties of MMH, 
incompatibility of MMH and 
gold 

STS-2 OV-102 
N 2 0 4 Spill 

j 

9/22/1981 i^ CPa ^ 39A 
i 207-Foot Level 

1 

! | 

Iron nitrates caused a QD to 
hang open, spilling 
approximately 15 to 20 gallons 
of N 2 0 4 , no injuries, notable 
flight hardware damage 

None 

Do not use QDs as shut off 
valves, inadequate spill 
protection 
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Incident 

Date 

Location 

Description 

Advance Warnina i Primary Lesson(s) Learned 

Pad 39A Fuel 
Farm MMH Spill 
and Fire 
Following 
Pneumatic Valve 
R&R 

6/29/1982 

KSC Pad 39A 
Fuel Farm 

Valve removal led to MMH 
geyser hitting hot metal cable 
tray and igniting, no injuries, 
some GSE hardware damage 

There was an indication on 
console in the LCC that 
several valves closed when 
the pneumatic control 
pressure was removed, fire 
was likely as a result of 
spilled fuel and local area 
containing iron oxide 

1 

| 

Removal of GN 2 control 
pressure allowed normally 
open valves to open, manual 
overrides added later 



N 2 0 4 Vapor 
Release from 
Flange Gasket 

2/10/1983 

KSC Pad 39A 
Oxidizer Farm 

r i 

A GSE valve gasket blew out, 
venting N 2 0 4 (N0 2 ) vapors to 
atmosphere, there were no 
injuries or hardware damage 

No warning other than loud 
noise moments before the 
vapor release 

The technicians and 
engineers responded 
correctly 

FRCS Ferry Plug 
Removal MMH 
Spill 

! 

4/18/1983 

KSC OPF1 

I 

Cold outside temperatures 
caused thruster MMH valves to 
leak and collect liquid in the 
chambers, a technician was 
exposed to liquid (less than 14 
cup) when a ferry plug was 
removed 

Knowledge that thruster 
valves leak at cold 
temperatures 

Keep thruster heaters on 
during all ferry flight and post- 
landing operations to prevent 
valve leakage 

STS-9 OV-102 
APU 1 and 2 
Explosion 

j 

12/8/1983 

EAFB Runway 
170 

Stress corrosion cracking was 
present in the APU injector stem 
thus causing an N 2 H 4 leak and 
explosion, no injuries, significant 
flight hardware damage 

Valve module cooling noted 
at about 17 minutes after 
APU-1 and -2 were started 
for entry (an indication of 
N 2 H 4 evaporation/leakage, 
shutdown of APU 1 as a 
result of an “underspeed” 
condition 

Injector stem is now 
chromized and manufacturing 
stresses are minimized 

| 

N 2 0 4 Vapor 
Release from 
Loose Fitting 

2/17/1984 

KSC OPF2 

A small amount of N 2 0 4 vapor 
was released from an 
improperly torqued fitting on the 
GSE oxidizer vent system, no 
injuries or hardware damage 

None 

Inadequate contractor 
oversight resulted in many 
incorrectly torqued fittings in 
the vent system 
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Incident 

Date Location 

Description 

Advance Warnina 

| 1 ' 

Primarv Lesson(s) Learned 

CCAFS Tanker 
MMH Fire 

5/16/1984 

CCAFS Fuel 
Storage Area 1 

MMH being drained from tanker 
low point sump ignited, 
technicians received minor 
burns through SCAPE suits, 
minor GSE hardware damage 

Fire was possible as a 
result of spilled fuel 

1 -1 

Was either result of 
electrostatic discharge from 
something nearby or reaction 
of MMH with local iron oxide 
(rust) 

Liquid Trap in 
Purge Adapter 
Flexhose MMH 
Spill 

1 

! 

5/24/1985 KSCOPF1 

Approximately 1 cup of MMH 
spilled from a thruster purge 
adapter and onto the body flap, 
minor injuries, minor flight 
hardware damage 

1 1 
1 

None 

l - 

Proper procedure controls 
could have prevented this 

QD anti-rotation devices were 
implemented for use after 
RTF from Challenger 

STS-61C OV-102 
SRB HPU 
Loading N 2 H 4 
Spill 

j 

12/8/1985 i^^ 39A 
j MLP Surface 

11 1 1 1 - 1 1 ' H 

During removal of Leer-Romec 
QD, AHC was spun off internal 
line leaking approximately 3 
gallons of N 2 H 4 , no injuries or 
damage 

-j 

Difference in mechanical 
motion during removal of 
QD 

J 

J 

Inadvertent Dry 
Well Removal 
MMH Spill 

h I - 

1 / 91 /iQftfi |KSCPad39A 
1/21/1986 i Fue|Farm 

■ 

A technician erroneously 
removed a temperature 
transducer dry well from a 3- 
inch GSE line causing a 12-foot 
geyser of MMH, spilling 100 
gallons, minor injuries, minor 
GSE damage 

1 

Difference in mechanical 
motion during removal of 
transducer along with its 
dry well 

Dry well retainers are now 
used on all hypergolic dry 
wells 

Relief Valve R&R 
Oxidizer Farm 
N 2 0 4 Vapor 
Release 

7/29/1986 | KSC Pad 39A 

During a relief valve R&R, a 
technician’s SCAPE suit tore 
delaying an operation where the 
N 2 0 4 storage tank was open to 
atmosphere releasing N 2 0 4 
(N0 2 ) vapors, minor injuries, no 
hardware damage 

Pressure indications on 
console showed a pressure 
differential of about 5 psig 
in the storage tank prior to 
the relief valve removal 

Engineering had request to 
modify the hardware which 
was denied until after this 
incident, inadequate time was 
given prior to the valve 
removal to allow the 
propellant to cool 

OPF2 Trench 
N 2 H 4 Spill and 
Fire 

i 

9/19/1986 j!5 SC ° PF2 
i T rench 

i 

i 

-| 

N 2 H 4 leaked from a GSE check 
valve fitting that did not have an 
o-ring, dripped into trench, and 
reacted with the residual debris 
in the trench, igniting, no injuries 
or damage 

-| 

Fire was possible as a 
result of spilled fuel 

Care needs to be taken when 
installing components in 
hypergolic ground support 
equipment, also, cleanliness 
should be scrutinized 
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Incident Date Location 

Description 

Advance Warnina ! Primarv Lesson(s) Learned 

N 2 0 4 and 

Insulation j K/ 9 o /iq oo |KSCPad39B 

Adhesive Small j j Oxidizer Farm 

Fire 

1 I 

During a sampling operation, 
liquid N 2 0 4 spilled onto some 
GSE line insulation adhesive 
and ignited, no injuries, minimal 
hardware damage 

1 An incompatibility exists 
1 between N 2 0 4 and the 

None | adhesive used, adhesive was 

i not given enough time to 
j properly cure 

STS-26R OV-103 ! 

N 2 0 4 Tubing Leak 1 7/14/1988 |KSCPad39B 
on Vehicle 

! 

j | 

! | 

A scratched LRCS N 2 0 4 
propellant tank ullage vent 
dynatube leaked vapors into 
vehicle at a rate of about 0.23 
psi/hour, no injuries or hardware 
damage 

1 

| 

Discovery of leak came 
from remote data 
monitoring of propellant 
tank pressure in LCC 

i 

Probable cause was that the 
incorrect fitting was leak 
checked, the ingenuity of the 
launch team resulted in only a 
short delay in the launch of 
Discovery 

i : 

^TFFue. | 2/16/1990 iWSTF 

Waste Flash Fire i i 

i ! 

i ! 

i 

Following the gravity draining of 
a fuel aspirator into a treatment 
tank, the residual vapors ignited, 
no injuries, minor hardware 
damage 

None 

Care needs to be taken in an 
environment that contains 
high concentrations of fuel 
vapors, they are highly 
susceptible to ignition 

i 

i j 

i j 

i j 

Aspiration of 

N 2 0 4 into Fuel 3/26/1990 WSTFTS401 

Vent System 

! 1 

! j 

A fuel (MMH) aspiration 
flexhose was mistakenly 
connected to the N 2 0 4 GSE 
manifold service valve instead of 
the fuel manifold service valve, 
evidence of internal ignition, no 
injuries, minor hardware 
damage 

None 

. 

Keying of the N 2 0 4 and MMH 
fittings was inadequate to 
preclude mismating, also the 
labeling and redundant 
labeling of the components 
was lacking 

j 

HMF Screens KSC HMF 

Test Drum MMH 12/7/1990 M7-961 East 

Spill | j Test Cell 

i i 

! ! 

The hard-line hose from a 
SCAPE suit caught on a GSE 
manual valve handle and 
opened it, filling a 55 gallon 
drum and subsequently spilling 
MMH out the drum’s relief valve, 
no injuries or damage 

None 

It was not wise to design the 
system in which a manual 
valve handle protruded 
beyond the edge of the panel 
allowing items to become 
caught on it 
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Incident 

Date Location 

Description Advance Warnina i Primarv Lesson(s) Learned 

STS-42 OV-103 
Ferry Plug 
Removal MMH 
Spill 

2/12/1992 IKSCOPF3 

0 . ........ . 1 1 Cold temperatures during a 

Similar to the incident : j 0 „, , r .. . . 

4/18/1983, less than a cup of ! Knowledge that thruster e . In , 

...... .. . 7 | . . , . . . : RCS thruster MMH valve to 

MMH spill from thruster when valves leak at cold . . . . . 

, . . ;. . i leak since vehicle remained 

ferry plug was removed, no temperatures . , .. .. . 

. . . a . . , ’ i r : unpowered and the thruster 

injuries or hardware damage . r . „ 

1 ! 1 heaters were off 

WSTF Incorrect 
Flight Cap N 2 0 4 
Exposure 

i 

I WSTF OMS 
11/4/1992 | Ground Test 
j Article 

A 14-inch AHC cap was placed i ! or . . . . . . 

onto a 14-inch AHC causing the j %” flight cap design is | decreased the 

poppet to depress and spill | noticeably different than a | jbj|jt f thj occurren ce 

liquid N 2 0 4 minor injuries, no | %” flight cap | 

hardware damage 

i 

Thermochemical 
Test Area N 2 0 4 
Vapor Release 

i 

j 

4/21/1994 JSCTTA 

! 

1 i 

i 

Approximately 16 gallons of I , ... , ... , 

1 .. ~ 3 . . . i Initial small release of 

! liquid N 2 0 4 vaporized and i ... . i TU . .. , ., . . .. 

a .. . I 4 r . . .. oxidizer vapors release The test team failed to notice 

i exited a burner stack as a result : .. . .. . . : . . 

, . , , .. , . through the burner stack, anomalous system 

of a leaky solenoid valve and i a . ... ’ , 

i . . . . . . . i pressure drop in the i performance and to take 

inadequately prepared test . .. ,, . . , r . . .. 

. ^ 3 . r . . . : oxidizer propellant tank : appropriate action 

team, some minor injuries, no , onr T . . \ ^ v 

i . . ’ . J ’ i from 800 psig to 600 psig i 

hardware damage j K a i 

i 

1 

1 

Titan IV A K-9 
N 2 0 4 Spill 

! 

i 

8/20/1994 | CCAFS SLC-41 
1 

! | 

N 2 0 4 liquid release of I . . .. . ... ! Schedule pressure can result 

! approximately 350-400 gallons j showed thelncrease in in leaving a system in an 

following thermal expansion ! ! undesirable configuration, 

causing a line to rupture at a j ! proper utilization of relief 

weld seam while static shortly j .. . | valves or ullage volumes 

after sunrise | monitorin g the 9 au 9 es | should be mandatory 

STS-69 OV-105 
Left Pod MMH 
Fire 

12/9/1994 KSCOPF1 

1 ! 

1 Pressure drop on console 1 „ ... . . . . 

■ ' th i rr h t ri 1 Proper training needs to take 

Decomposition reaction of MMH ! In e . . Ia ' ca e . . ! place for all parties (including 

,, . , ... . : aspirator had been placed iTu a 

in open thruster feedline caused .. .. .. » the engineers) relating to 

1 . ... „. . . : directly over thruster i a a 

ignition, no injuries or flight , . v . emergency response, 

i a . ’ . J a i feedline, in-rush if air likely :. ,J ^ l t - \- 

hardware damage . . . \ ... 3 hypergol fire identification, 

a i started decomposition i 7, .. 

i .. r j and communication 

reaction 
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Incident 

Date Location 

Description 

| 

Advance Warnina 

| 1 | 

! Primarv Lesson(s) Learned 

STS-69 OV-105 
Right Pod MMH 
Fire 

: 

: 

5/4/1995 KSCOPF1 

MMH was present in a manifold 
that was having a dynatube 
disconnected, fire ignited 
possibly from an electrostatic 
discharge or decomposition 
reaction, no injuries, appreciable 
flight hardware damage 

Transducer bias and shift 
change caused any 
advance warning to go 
unnoticed, but it did exist in 
the data 

A transducer offset was not 
accounted for thus hiding an 
increase in the manifold 
pressure, proper care was not 
taken with respect to 
electrostatic discharge and 
fire extinguishing equipment 

ORSU Open 
Manual Valve 
N 2 0 4 Spill 

1 WSTF 400-Area 
3/1/1996 N 2 0 4 Storage 

I Area 

Liquid N 2 0 4 (approximately 90 
gallons) poured from the vent 
stack of the storage tank, no 
injuries or hardware damage 

None 

Improper configuration 
management (manual valve 
left slightly open) existed in 
the 400-area vent system 

OPF2GSEMMH 

Spill 

j 

2/17/1997 KSCOPF2 

1 1 

Approximately a pint of MMH 
spilled from a line when the cap 
was removed, injuring three 
technicians, no hardware 
damage 

When cap was initially 
disconnected a few drops 
of liquid were noted, 
technicians did not believe 
it was fuel and continued on 

1 

An unrecognized low point in 
the line allowed the MMH 
liquid to collect 

I 

1 

HMF Sample 
Valve MMH Spill 

J 

! ! 

KSCHMF 

3/26/1997 | M7-1212 West 
| Test Cell 

L L J 

Approximately 3 A-cup of MMH 
spilled from a sample valve port, 
MMH collected in flexhose low 
point, minor injuries, no 
hardware damage 

None 

MMH was not saturated with 
helium which aids the draining 
procedure 

VAFB Titan IV K- 
18 N 2 0 4 Spill 

1 

| 1 

j 1 

7/16/1997 | VAFB SLC-4E 

Three of four Titan IV SRM TVC 
FCVs failed during system 
pressurization spilling about 244 
gallons of liquid N 2 0 4 onto the 
vehicle SRM aft skirts and 
ground, no injuries, minor flight 
hardware damage 

None 

Incompatible cleaning agents 
caused a seal in the FCV to 
rapidly expand within the 
valve when the Bio T-200A 
cleaning agent reacted with 
liquid N 2 0 4 , proper scrutiny of 
material compatibility was not 
completed on a newly design 
component 
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Incident 

Date Location 

Description 

| 

Advance Warnina 

| 1 ' | 

! Primarv Lesson(s) Learned 

Pad 39B Slope 
N 2 0 4 Spill 

| 

11/6/1997 |KSCPad39B 
| Slope 

i 

i 

i 

i 

1 

An undersized flange gasket 
and improper mounting brackets 
enabled a water hammer effect 
to spill 25-50 gallons of liquid 
N 2 0 4 on the pad B slope, an 
electrical fire ensued when the 
liquid N 2 0 4 contacted some 
nearby live cabling, no injuries, 
minor GSE hardware damage 

Discrepancy between the 
flange drawings for launch 
pads 39A and 39B, this 
type of advance warning 
was obscure and, therefore, 
not surprising that it went 
unnoticed 

Improper configuration 
management by improper 
drawing specifications, 
drawings were not updated to 
require the installation of the 
proper gaskets as the pad A 
drawings were, cross-over 
valve complex was removed 
and replaced with hard-line 
tubing 

. 

STS- 109 OV-102 
APU N 2 H 4 Spill 

! 

i 

i 

i 

8/20/1999 IKSCOPF3 
i 

About 4.5 tbsp of liquid N 2 H 4 ran 
down a flexhose from the high 
point bleed QD and dripped on 
the orbiter elevon, no injuries, 
minimal flight hardware damage 

| - L - - - - - - ...... -- T - - "1 

Uncapped flexhose 

! 

| 

New GSE was designed and 
installed to prevent this in the 
future 

WSTF Pathfinder 
Axial Engine 
Valve Failure 

i 

i 

! 

i 

i 

8/7/2000 | WSTF TS 401 

j 

i 

i 

1 

During a decontamination 
procedure following an engine 
hotfire test, an axial engine 
valve and N 2 0 4 tubing failed 
(exploded) causing extensive 
damage to surrounding 
hardware, no injuries 

N0 2 vapor release at test 
cell drain valve, large cloud 
of N0 2 vapor when engine 
valves were cycled 

Working steps out of 
sequence and several days 
later than required along with 
performing the procedure with 
a temporary procedure rather 
than a permanent procedure 
were likely contributors to this 
event 



WSTF Pathfinder 
Small MMH Fire 

r r _ ] 

! 

1 

8/12/2000 WSTF TS 401 

j 

: 

j j 

i i 

Small amount of MMFI dripped 
from a disconnected feedline 
and ignited, minimal hardware 
damage and no injuries 

! 

i" " 

Fire was possible as a 
result of spilled fuel 

This event was likely the 
result of several issues 
compounding including 
ramifications from the incident 
that occurred on the same 
test article a few days prior 

WSTF Pressure 

Transducer 

Explosion 

1 

j 

: i 

j 

! 1 

3/25/2003 1 WSTF TC 831 

; i 

i | 

j 

! 1 
j 

j | 

1 

A pressure transducer 
diaphragm failed causing N 2 0 4 
to leak into a volume filled with 
silicon oil leading to an 
explosion and a vapor release of 
approximately 3 quarts, no 
injuries, some hardware 
damage 

None 

— 

The pressure transducer 
manufacturer did not make 
the user aware that the 
transducer contained silicon 
oil 
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Incident 

Date Location 

Descriotion 

Advance Warnina 

| 1 | 

! Primarv Lesson(s) Learned 

Titan IV N 2 0 4 
Pump Explosion 

8/12/2003 

| 

i 

! 

A clogged filter in the 
recirculation loop of the pump 
resulted in an increase in N 2 0 4 
(N0 2 ) vapors and a decrease in 
the lubrication of the stator 
allowing N 2 0 4 to breach the 
stator can and leak into the 
copper windings, causing an 
explosion, minor injuries, major 
GSE hardware damage 

| 

Decrease in oxidizer pump 
flow rate that was 
disregarded under the 
belief that it was a result of 
partially clogged filter 

| 

! 

i 

! 

j 

Improper maintenance of the 
pumps and possible design 
flaws led to the explosion 

! 

! 

. 

HMF RP01 N 2 0 4 
Spill 

J 

j 

| | 

KSC HMF 

6/5/2004 M7-961 East 

! Test Cell 

! 

| | 

A flight cap was removed while, 
unknowingly, the AHC poppet 
was stuck slightly in the open 
state leaking roughly 1.4 gallons 
of N 2 0 4 , minor injuries and no 
hardware damage 

! 1 

Opaque Tygon hose and 
lack of time constraint on 
formation of bubbles 
covered up any advance 
indications, but it was likely 
present 

! 

The most probable causes 
include improper and/or 
inadequate bleed procedures, 
degradation of process and/or 
system knowledge over time, 
or nitrate buildup on the flight 
cap bleed port 

WSTF N 2 H 4 Spill 
Following Manual 
Valve Failure 

| 

: 

9/30/2005 WSTFTC844B 

A manual valve bonnet (handle) 
failed in a IAPU GSE setup 
spilling approximately 74 gallons 
of liquid N 2 H 4 into the test cell, 
no injuries, some GSE hardware 
damage 

None 

The valve soft seals failed 
thus leaking liquid N 2 H 4 into 
an internal area where an 
aluminum bronze fitting was 
located, over time the fitting 
corroded and later failed 
spilling the N 2 H 4 

STS-121 FRC3 
N 2 0 4 Spill 

KSC HMF 

1/9/2006 | M7-1212 West 
! Test Cell 
| 

Approximately 2.9 gallons of 
N 2 0 4 spilled following removal of 
AHC MD122 poppet, no injuries, 
some flight hardware damage 

None 

Closer scrutiny of procedures 
and spill protection could 
have reduced the likelihood of 
this spill 
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[lit] 


Onto/Into 


Apollo 7 SPS 
N 2 0 4 Spill 

Sept. 1968 

~1 to 2 
gal 

Pad structure 
and 
vehicle 

Apollo-Soyuz 
Astronaut N 2 0 4 
Vapor Exposure 

7/24/1975 

Vapors 

Into crew 
compartment 

OV-101 APU 1 
Cavity Seal N 2 H 4 
Spill 

6/28/1977 

~5 gal 

Into vehicle 
aft 

compartment 

Titan II Silo Large 
Scale N 2 0 4 Spill 

' 

8/24/1978 

13,450 

gal 

Bottom of 
missile silo 

N 2 H 4 Spill 
Following APU 
Hotfire 

r 1 

Nov. 1979 

~2gal 

OPF1 

platforms 


Fuel Explosion 
Fuel Injuries 


Commodity, Type, Injuries, and/or Damage 


Root Cause 


Occurred During 
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Spilled 

Incident Date Quantity Onto/Into 


Titan II Explosion 
Following A-50 
Spill 

9/18/1980 

11,140 

gal 

Bottom of 
missile silo 

KSC Incorrect 
Flight Cap N 2 0 4 
Vapor Release 

July 1981 

Vapors 

OPF1 

MMH Exposure 
Following 
Flexhose 
Removal at Pad 
Farm 

7/14/1981 

1 - -1 

< Vz gal 

_| 

Ground and 
technician 

STS-2 OV-102 
Right Pod MMH 
Fire 

1 

Fall 1981 

— 

~1 tsp 

Into vehicle 
pod 

STS-2 OV-102 
N 2 0 4 Spill 

9/22/1981 

15 to 20 
gal 

Onto vehicle 
and pad 
structure 


Commodity, Type, Injuries, and/or Damage 
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Liquid Trap in 
Purge Adapter 
Flexhose MMH 
Spill 


STS-61C OV-102 
SRB HPU 
Loading N 2 H 4 
Spill 


Inadvertent Dry 
Well Removal 
MMH Spill 


Relief Valve R&R 
Oxidizer Farm 
N 2 0 4 Vapor 
Release 

OPF2 Trench 
N 2 H 4 Spill and 
Fire 


5/24/1985j ~1 cup j Onto vehicle X 


12/8/1985 


1/21/1986 


7/29/86 


9/19/1986 


-100 gal 


Vapors 


Onto MLP 
surface 


Ground and 
farm sump 


Atmosphere 


OPF2 trench 
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N 2 0 4 and 
Insulation 
Adhesive Small 
Fire 

6/23/1988 

~2 tbsp 

Onto line 
insulation 

STS-26R OV-103 
N 2 0 4 Tubing Leak 
on Vehicle 

7/14/1988 

Vapors 

Into vehicle 
pod 

WSTF Fuel 
Waste Flash Fire 

2/16/1990 

None 

spilled 

None 

Aspiration of N 2 0 4 
into Fuel Vent 
System 

3/26/1990 

~2 tbsp 

Into fuel vent 
system 

— 

FIMF Screens 
Test Drum MMH 
Spill 

__ 

12/7/1990 

■ 

~1 to 2 
gal 

Onto drum 
and HMF 
floor 

STS-42 OV-103 
Ferry Plug 
Removal MMH 
Spill 

2/12/1992 

~y 4 to % 
cup 

OPF3 platform 
and 

technician 
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During Hypergol Operation 
During Opened System 
During Static Configuration 





























WSTF Incorrect 



Ground and 
technician 

Flight Cap N 2 0 4 
Exposure 

11/4/1992 

~1 cup 

Thermochemical 


~16 to 20 
gal 

Out burner 

Test Area N 2 0 4 

4/21/1994 

stack onto 

Vapor Release 


ground 

Titan IV A K-9 

8/20/1994 

350 to 

Launch pad 

N 2 0 4 Spill 

400 gal 

transfer slip 

STS-69 OV-105 



Into vehicle 
pod 

Left Pod MMH 
Fire 

12/9/1994 

< 1 cup 

STS-69 OV-105 



Into vehicle 
pod 

Right Pod MMH 
Fire 

5/4/1995 

< 1 cup 

ORSU Open 




Manual Valve 
N 2 0 4 Spill 

3/1/1996 

~90 gal 

Ground 






Root Cause 


No Damage or Injuries 

Procedure Adherence/Control 

Improper Personnel Training 
Human Error (Operations) 

Improper GSE/Vehicle Design 

Improper Config. Management 

During Commodity Movement 

During R&R 

During Hypergol Operation 

IH 
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OPF2 GSE MMH 
Spill 

2/17/1997 

~1 pint 

OPF2 platform 
and 

technicians 

HMF Sample 
Valve MMH Spill 

3/26/1997 

~ 3 /> cup 

HMF platform 
and 

technician 

VAFB Titan IV 
K-I 8 N 2 O 4 Spill 

7/16/1997 

-244 gal 

Vehicle and 
ground 

Pad 39B Slope 
N 2 0 4 Spill 

11/6/1997 

25 to 50 
gal 

Ground and 
pad slope 

STS- 109 OV-102 
APU N 2 H 4 Spill 

8/20/1999 

< 5 tbsp 

Onto vehicle 
elevon 

WSTF Pathfinder 
Axial Engine 
Valve Failure 

8/7/2000 

-1 to 2 
gal 

Into test cell 

WSTF Pathfinder 
Small MMH Fire 

8 / 12/2000 

-1 cup 

Nearby 
hardware and 
technician 
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Spilled 


Date 

Quantity Onto/Into 


WSTF Pressure 

Transducer 

Explosion 

3/25/2003 j ~3 quarts 

Test cell table 

Titan IV N 2 0 4 
Pump Explosion 

8/12/2003 | -40 gal 

Ground 

HMF RP01 N 2 0 4 
Spill 

j 

6/5/2004 ~1.4 gal 

HMF platform 
and 

technician 

WSTF N 2 H 4 Spill 
Following Manual 
Valve Failure 

9/30/2005 | -74 gal 

Into cell and 
containment 
tank 

STS-121 FRC3 
N 2 0 4 Spill 

1/9/2006 | -2.9 gal 

HMF platform 


45 Total Incidents Reported 


Total 



24 ! 8 ! 2 | 7 1 12 16 ! 7 j 3 j 3 j 8 ! 12 ! 10 7 j 1 1 j 17 24 ! 1 1 18 15141 13 j 3 
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